Daily brief 2026-11-11: CVE-2026-89324 and what businesses should patch

CVE-2026-89324 (CVE-2026-89324): The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all ve. Severity CRITICAL, CVSS 9.8, EPSS n/a.

CVE-2026-121904 (CVE-2026-121904): Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could . Severity CRITICAL, CVSS 9.6, EPSS n/a.

CVE-2026-126542 (CVE-2026-126542): WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows. Severity CRITICAL, CVSS 9.3, EPSS n/a.

CVE-2026-121355 (CVE-2026-121355): Adobe Connect is affected by an Incorrect Authorization vulnerability that could result in. Severity CRITICAL, CVSS 9.1, EPSS n/a.

CVE-2026-126537 (CVE-2026-126537): The Ninja Forms - File Uploads add-on for WordPress is vulnerable to Arbitrary File Deleti. Severity CRITICAL, CVSS 9.1, EPSS n/a.

WordPress & websites: CVE-2026-89324, CVE-2026-126537. See the Business Apps page for what to ask your provider.

Prioritize anything in CISA KEV and anything internet-facing (VPNs, firewalls, web servers, remote-support tools). Confirm patch status across every client tenant, and kill active sessions after patching gateway appliances.

CVE-2026-89324 affects CVE-2026-89324. Patch the server or plugin, put a web application firewall in front, and review logs for exploitation.

CVE-2026-126537 affects CVE-2026-126537. Patch the server or plugin, put a web application firewall in front, and review logs for exploitation.

Ask your IT provider which of these products you run, and get written confirmation they are patched or mitigated.

Enforce MFA, keep tested offline backups, and make sure remote access is not exposed without protection.