Open-source business platforms, week 39 2026: exploited WordPress flaw among 17 vulnerabilities

The release at a glance

The maintainers of GLPI, Frappe/ERPNext, WordPress and Nextcloud published 17 vulnerabilities for week 39 (21–27 September 2026): 16 CVEs and one advisory without a CVE. GLPI accounts for 13 entries, Frappe/ERPNext for two, WordPress for one and Nextcloud for one. Severity counts are one critical, eight high and eight medium.

One issue is actively exploited: CVE-2026-87902 in WordPress, listed in CISA KEV and in ENISA EUVD as exploited since 23 September 2026. It allows an unauthenticated attacker to influence page-template resolution so a readable local .php file outside the active theme is included; with the right server and theme pre-conditions, remote code execution is possible. The remaining issues are not reported as exploited but include critical and high-severity RCE, file deletion, SQL injection and authentication problems in GLPI.

What matters most

WordPress: CVE-2026-87902 (CVSS 3.1: 8.1) is the only issue in this week's set known to be actively exploited. An unauthenticated attacker can make get_page_template() include a chosen readable local .php file outside the active theme directories; with suitable server and theme pre-conditions, this results in remote code execution. Update to WordPress 7.1.2 or the fixed backported releases listed in the advisory.

GLPI: The most severe GLPI issue is CVE-2026-48482 (CVSS 4.0: 9.4), a critical form-import flaw. A form administrator can use a crafted illustration or scene identifier to traverse outside the intended custom-asset directory, write a file to an executable server location, and invoke it remotely. Fixed in 11.0.8.

CVE-2026-47679 (CVSS 4.0: 8.5) lets any logged-in user request deletion of an attacker-selected server file through the profile-picture update flow; fixed in 10.0.26 and 11.0.8.

CVE-2026-53629 (CVSS 4.0: 7.1) is SQL injection in the history tab, reachable by a user with READ right on logs; fixed in 10.0.26 and 11.0.8.

CVE-2026-53625 (CVSS 4.0: 7.5) allows a technician to change another user's authentication method through the API, potentially enabling account takeover under legacy API REST or SSO configurations; fixed in 10.0.26 and 11.0.8.

CVE-2026-49470 (CVSS 4.0: 7.7) lacks rate limiting on TOTP verification, allowing brute-force compromise of the second factor; fixed in 11.0.8.

Nextcloud: CVE-2026-77165 (CVSS 3.0: 6.5) leaves TYPE_TOKEN locks unremovable by file owners, with no recovery path outside the database. No fixed version or workaround is listed.

Patch in this order

1. Update WordPress to 7.1.2, or the fixed backported releases listed in the advisory, to address exploited CVE-2026-87902. CISA's KEV due date is 28 September 2026. This is the only issue in this week's set known to be actively exploited.

1. Upgrade GLPI deployments from 11.0.0 before 11.0.8 to 11.0.8 to close CVE-2026-48482, the critical form-import remote code execution flaw.

1. For GLPI running from 10.0.0 before 10.0.26 or from 11.0.0 before 11.0.8, update to 10.0.26 or 11.0.8 respectively to address CVE-2026-47679, CVE-2026-53629, CVE-2026-53625 and CVE-2026-53628.

1. Update GLPI to 11.0.8 for CVE-2026-55214, CVE-2026-53610, CVE-2026-53626, CVE-2026-53627 and CVE-2026-49470.

1. For Nextcloud Server, CVE-2026-77165 has no fixed version listed and no stated workaround. Confirm whether your version is within 32.0.0 to 34.0.0 and monitor for a fix.

1. Review the remaining medium-severity advisories: GHSA-hxfh-hh23-fvch in Frappe Framework (6.1), CVE-2026-96672 in ERPNext (5.3), and GLPI CVE-2026-45801, CVE-2026-55217 and CVE-2026-49469. These are not in CISA KEV and are not reported as exploited.

Beyond the patch

Because CVE-2026-87902 is actively exploited, Managed Detection & Response (MDR) provides the first line of detection and response for public WordPress instances. The WordPress flaw is reachable over the network without credentials, so a Virtual CISO Services (vCISO) review can help identify exposed or unpatched assets before they are targeted.