Daily brief 2026-11-06: CVE-2026-107622 and what businesses should patch

CVE-2026-107622 (CVE-2026-107622): The BuddyForms plugin for WordPress is vulnerable to Privilege Escalation in all versions . Severity CRITICAL, CVSS 9.8, EPSS n/a.

CVE-2026-119757 (CVE-2026-119757): BTCPay Server before 2.4.2, including 2.4.2 release candidates, contains an information di. Severity CRITICAL, CVSS 9.3, EPSS n/a.

CVE-2026-114630 (CVE-2026-114630): The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable. Severity CRITICAL, CVSS 9.1, EPSS n/a.

CVE-2026-123158 (CVE-2026-123158): sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workar. Severity HIGH, CVSS 8.1, EPSS n/a.

WordPress & websites: CVE-2026-107622, CVE-2026-114630. See the Business Apps page for what to ask your provider.

Prioritize anything in CISA KEV and anything internet-facing (VPNs, firewalls, web servers, remote-support tools). Confirm patch status across every client tenant, and kill active sessions after patching gateway appliances.

CVE-2026-107622 affects CVE-2026-107622. Patch the server or plugin, put a web application firewall in front, and review logs for exploitation.

CVE-2026-114630 affects CVE-2026-114630. Patch the server or plugin, put a web application firewall in front, and review logs for exploitation.

Ask your IT provider which of these products you run, and get written confirmation they are patched or mitigated.

Enforce MFA, keep tested offline backups, and make sure remote access is not exposed without protection.