5
CVEs
5
Critical
0
High
0
KEV
0
PoC
5
Unpatched C/H
0.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
5
HIGH
0
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (8)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-39770 | Unauthenticated arbitrary file upload in the Doctreat WordPress theme (versions up to and including 1.7.0) allows remote attackers to upload and execute malicious files, potentially leading to complete site takeover. The flaw requires no authentication or user interaction and affects only sites running this specific commercial Amentotech theme. No public exploit code was identified at the time of analysis, but the critical severity warrants immediate remediation. | CRITICAL | 10.0 | 0.4% | 50 |
No patch
|
| CVE-2026-39773 | Unauthenticated privilege escalation in the Doctreat Core WordPress plugin (versions 1.7.0 and earlier, vendor namespace amentotech) lets a remote visitor gain administrator-level rights on any affected site without logging in, supplying credentials, or interacting with a victim. The input assigns a maximal CVSS 3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), reflecting a low-complexity, unauthenticated, network-reachable flaw with scope change and full loss of confidentiality, integrity, and availability; only sites with this specific plugin installed and un-updated are in scope. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data. | CRITICAL | 10.0 | 0.3% | 50 |
No patch
|
| CVE-2026-39757 | Arbitrary file upload in the WordPress plugin Taskbot (versions 6.6 and earlier) lets an authenticated attacker with only a subscriber-level account upload executable files to the server, which can be leveraged to run code and take full control of the hosting site. The vulnerability is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and stems from missing file type/extension validation in the plugin's upload handler (CWE-434); the scope-change metric reflects that compromising the plugin escalates into compromise of the whole WordPress installation. Exploitation requires a valid account at the subscriber role or higher - on sites that allow self-registration, that role is trivially obtainable by anyone, lowering the effective barrier close to unauthenticated. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has not published a fixed version in the available data, so sites running Taskbot 6.6 or earlier should treat this as high priority. | CRITICAL | 9.9 | 0.5% | 50 |
No patch
|
| CVE-2026-39759 | Arbitrary file upload in the Amentotech Workreap Core WordPress plugin (all versions through 3.4.5) lets an authenticated attacker who holds an Employer or Sales Representative role push attacker-controlled files onto the server, which on a standard WordPress/LAMP stack typically escalates to remote code execution and full site takeover. The issue is scored CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), and the scope-change metric reflects that the impact crosses out of the plugin into the underlying host, while the low complexity and lack of user interaction mean an attacker only needs a valid low-privileged account. There is no CISA KEV listing and no public exploit identified at time of analysis, but the practical barrier collapses on sites that allow open self-registration of employer or vendor accounts, making this a genuine high-priority vulnerability that should be patched promptly. | CRITICAL | 9.9 | 0.5% | 50 |
No patch
|
| CVE-2026-39753 | Unauthenticated privilege escalation in the Amentotech Taskbot plugin for WordPress (versions 6.6 and earlier) allows any remote attacker to elevate privileges on a vulnerable site without credentials or victim interaction, as reflected by the CVSS 3.1 vector PR:N/UI:N/AC:L and a 9.8 base score. Because the flaw sits in privilege-assignment logic that is reachable in the plugin's default configuration, a standard installation that simply has Taskbot active is exposed; the practical limiting factor is that exposure depends entirely on this relatively uncommon plugin being deployed. There is confirmed actively exploited status absent - no CISA KEV entry was provided - and no public exploit code was identified in the supplied intelligence at time of analysis, so this should be prioritized on the basis of severity and ease of exploitation rather than observed attacks, with the caveat that corroborating intelligence is sparse and comes primarily from the Patchstack report. | CRITICAL | 9.8 | 0.4% | 49 |
No patch
|