# Automattic vulnerabilities Source: https://junglewise.ai/threats/vendors/automattic Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 20:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/automattic.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 37 vulnerabilities in Automattic: 4 in the last 7 days and 32 in the last 90 days, 5 of them critical and 1 exploited in the wild. The most recent, CVE-2026-118439, was published on 11 November 2026. 5 vulnerabilities in the last four weeks, down 64% on the four before (14). 1 critical against 1, 1 exploited in the wild against 0. 3 technologies have a page of their own. ## Counts - Last 7 days: 4 - Last 30 days: 8 - Last 90 days: 32 - All time: 37 (5 critical, 1 exploited in the wild) ## About Automattic Automattic is a web development corporation best known for WordPress.com and its contributions to the WordPress ecosystem. ## Latest Automattic vulnerabilities - [CVE-2026-118439: Limit Login Attempts Reloaded SSRF in setup code validation](https://junglewise.ai/threats/cve-2026-118439-the-limit-login-attempts-security-wordpress-plugin-before-3-4-2) (info, published 11 Nov 2026) - [CVE-2026-125120: Mongoose sanitizeFilter not applied on countDocuments](https://junglewise.ai/threats/cve-2026-125120-mongoose-sanitizefilter-not-applied-on-countdocuments) (critical, CVSS 9.8, published 9 Nov 2026) - [CVE-2026-125119: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12…](https://junglewise.ai/threats/cve-2026-125119-mongoose-connection-level-sanitizefilter-not-applied) (high, CVSS 7.5, published 9 Nov 2026) - [CVE-2026-125117: Mongoose prototype pollution in object initialization](https://junglewise.ai/threats/cve-2026-125117-mongoose-is-a-mongodb-object-modeling-tool-designed-to-work-in) (high, CVSS 8.2, published 9 Nov 2026) - [CVE-2026-119977: WordPress Core remote code execution in upgrade path](https://junglewise.ai/threats/cve-2026-119977-wordpress-core-is-vulnerable-to-remote-code-execution-in) (critical, exploited in the wild, CVSS 8.1, published 31 Oct 2026) - [CVE-2026-102905: Ad Inserter arbitrary shortcode execution in dynamic tags](https://junglewise.ai/threats/cve-2026-102905-the-the-ad-inserter-ad-manager-adsense-ads-plugin-for-wordpress) (medium, CVSS 6.5, published 30 Oct 2026) - [CVE-2026-100158: SQL Chart Builder stored cross-site scripting in chart rendering](https://junglewise.ai/threats/cve-2026-100158-the-sql-chart-builder-plugin-for-wordpress-is-vulnerable-to) (medium, CVSS 6.4, published 16 Oct 2026) - [CVE-2026-103525: FluentCart Insecure Direct Object Reference in order data](https://junglewise.ai/threats/cve-2026-103525-the-fluentcart-a-new-era-of-ecommerce-faster-lighter-and-simpler) (high, CVSS 7.5, published 16 Oct 2026) - [CVE-2026-89097: Ad Inserter sensitive information exposure](https://junglewise.ai/threats/cve-2026-89097-the-ad-inserter-ad-manager-adsense-ads-plugin-for-wordpress-is) (medium, CVSS 4.3, published 13 Oct 2026) - [CVE-2026-97183: WP-Invoice missing capability checks in AJAX handlers](https://junglewise.ai/threats/cve-2026-97183-the-wp-invoice-wordpress-plugin-through-4-3-1-does-not-perform) (medium, CVSS 4.3, published 11 Oct 2026) - [CVE-2026-62130: WooCommerce Multilingual & Multicurrency PHP Object Injection](https://junglewise.ai/threats/cve-2026-62130-shop-manager-php-object-injection-in-woocommerce-multilingual) (high, CVSS 7.2, published 10 Oct 2026) - [CVE-2026-106608: Automattic WooCommerce privilege assignment vulnerability](https://junglewise.ai/threats/cve-2026-106608-incorrect-privilege-assignment-vulnerability-in-automattic) (high, CVSS 7.2, published 10 Oct 2026) - [CVE-2026-106602: Automattic Jetpack authentication bypass via alternate path](https://junglewise.ai/threats/cve-2026-106602-authentication-bypass-using-an-alternate-path-or-channel) (medium, CVSS 4.8, published 9 Oct 2026) - [CVE-2026-106601: Automattic Jetpack authentication bypass in password recovery](https://junglewise.ai/threats/cve-2026-106601-authentication-bypass-using-an-alternate-path-or-channel) (medium, CVSS 5.4, published 9 Oct 2026) - [CVE-2026-66666: WordPress sensitive data exposure in transmitted data](https://junglewise.ai/threats/cve-2026-66666-insertion-of-sensitive-information-into-sent-data-vulnerability) (info, published 6 Oct 2026) - [CVE-2026-92243: Ivory Search WordPress Search Plugin reflected XSS via search parameter](https://junglewise.ai/threats/cve-2026-92243-the-ivory-search-wordpress-search-plugin-plugin-for-wordpress-is) (medium, CVSS 6.1, published 3 Oct 2026) - [CVE-2026-97637: WordPress JSON API Auth authentication bypass via cached session cookie](https://junglewise.ai/threats/cve-2026-97637-the-json-api-auth-plugin-for-wordpress-is-vulnerable-to) (critical, CVSS 9.8, published 2 Oct 2026) - [CVE-2026-96647: Listdom AI-powered Business Directory Stored Cross-Site Scripting](https://junglewise.ai/threats/cve-2026-96647-the-listdom-ai-powered-business-directory-with-classifieds-ads) (medium, CVSS 6.4, published 2 Oct 2026) - [CVE-2026-101925: WordPress BBP Style Pack plugin stored cross-site scripting](https://junglewise.ai/threats/cve-2026-101925-the-bbp-style-pack-plugin-for-wordpress-is-vulnerable-to-stored) (medium, CVSS 6.4, published 1 Oct 2026) - [CVE-2026-96823: Customer Reviews for WooCommerce arbitrary content deletion](https://junglewise.ai/threats/cve-2026-96823-unauthenticated-arbitrary-content-deletion-in-customer-reviews) (high, CVSS 7.5, published 30 Sep 2026) - [CVE-2026-96524: MCP Server for WordPress CSRF in REST API nonce verification](https://junglewise.ai/threats/cve-2026-96524-the-mcp-server-for-wordpress-wordpress-plugin-before-1-8-2-does) (info, published 26 Sep 2026) - [CVE-2026-92799: WordPress Bookly authorization bypass via type juggling](https://junglewise.ai/threats/cve-2026-92799-the-online-scheduling-and-appointment-booking-system-bookly) (medium, CVSS 5.3, published 25 Sep 2026) - [CVE-2026-94671: WordPress The Post Grid cross-site scripting](https://junglewise.ai/threats/cve-2026-94671-contributor-cross-site-scripting-xss-in-the-post-grid-7-9-5) (medium, CVSS 6.5, published 23 Sep 2026) - [CVE-2026-89050: Quads Ads Manager payment bypass in ad-selling order processing](https://junglewise.ai/threats/cve-2026-89050-quads-ads-manager-payment-bypass-in-ad-selling-order-processing) (medium, CVSS 4.3, published 13 Sep 2026) - [CVE-2026-84023: BEAR WordPress plugin CSRF in taxonomy term modification](https://junglewise.ai/threats/cve-2026-84023-bear-wordpress-plugin-csrf-in-taxonomy-term-modification) (medium, CVSS 6.5, published 12 Sep 2026) ## Most severe Automattic vulnerabilities - [CVE-2026-119977: WordPress Core remote code execution in upgrade path](https://junglewise.ai/threats/cve-2026-119977-wordpress-core-is-vulnerable-to-remote-code-execution-in) (critical, exploited in the wild, CVSS 8.1, published 31 Oct 2026) - [CVE-2026-97637: WordPress JSON API Auth authentication bypass via cached session cookie](https://junglewise.ai/threats/cve-2026-97637-the-json-api-auth-plugin-for-wordpress-is-vulnerable-to) (critical, CVSS 9.8, published 2 Oct 2026) - [CVE-2026-125120: Mongoose sanitizeFilter not applied on countDocuments](https://junglewise.ai/threats/cve-2026-125120-mongoose-sanitizefilter-not-applied-on-countdocuments) (critical, CVSS 9.8, published 9 Nov 2026) - [CVE-2026-13598: RestrictMate privilege escalation in user registration](https://junglewise.ai/threats/cve-2026-13598-restrictmate-privilege-escalation-in-user-registration) (critical, CVSS 9.8, published 23 Aug 2026) - [CVE-2022-50972: WooCommerce remote code execution in product-type parameter](https://junglewise.ai/threats/cve-2022-50972-woocommerce-remote-code-execution-in-product-type-parameter) (critical, CVSS 9.8, published 20 Jun 2026) - [CVE-2026-125117: Mongoose prototype pollution in object initialization](https://junglewise.ai/threats/cve-2026-125117-mongoose-is-a-mongodb-object-modeling-tool-designed-to-work-in) (high, CVSS 8.2, published 9 Nov 2026) - [CVE-2026-57777: Automattic WooCommerce SQL injection in Analytics reports](https://junglewise.ai/threats/cve-2026-57777-automattic-woocommerce-sql-injection-in-analytics-reports) (high, CVSS 7.6, published 4 Sep 2026) - [CVE-2026-125119: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. From 6.0.0 until 6.13.12…](https://junglewise.ai/threats/cve-2026-125119-mongoose-connection-level-sanitizefilter-not-applied) (high, CVSS 7.5, published 9 Nov 2026) - [CVE-2026-48888: Automattic WooCommerce denial of service via resource exhaustion](https://junglewise.ai/threats/cve-2026-48888-automattic-woocommerce-denial-of-service-via-resource-exhaustion) (high, CVSS 7.5, published 8 Sep 2026) - [CVE-2026-103525: FluentCart Insecure Direct Object Reference in order data](https://junglewise.ai/threats/cve-2026-103525-the-fluentcart-a-new-era-of-ecommerce-faster-lighter-and-simpler) (high, CVSS 7.5, published 16 Oct 2026) ## Vulnerabilities per week 5 vulnerabilities in the last four weeks, down 64% on the four before (14). 1 critical against 1, 1 exploited in the wild against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 3 | 1 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 3 | 0 | 0 | | 7 Sep 2026 | 3 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 3 | 0 | 0 | | 28 Sep 2026 | 5 | 1 | 0 | | 5 Oct 2026 | 6 | 0 | 0 | | 12 Oct 2026 | 3 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 2 | 1 | 1 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 4 | 1 | 0 | ## Automattic technologies - [Automattic WooCommerce](https://junglewise.ai/threats/technologies/woocommerce): 4 vulnerabilities - [Automattic Mongoose](https://junglewise.ai/threats/technologies/automattic-mongoose): 3 vulnerabilities - [Automattic Jetpack](https://junglewise.ai/threats/technologies/jetpack): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Automattic vulnerabilities", https://junglewise.ai/threats/vendors/automattic, 12 November 2026.