TPRM Insights: TrueConf, OpenSSL, Apache Tomcat, PostgreSQL, WordPress Elementor

Introduction

This week's Focus Friday covers five FocusTags spanning video conferencing infrastructure, cryptographic library software, Java application servers, relational database management systems, and WordPress plugin ecosystems. TrueConf Server carries confirmed CISA KEV listings and nation-state exploitation by the Head Mare APT group deploying the PhantomCore backdoor — including the particularly dangerous tradecraft of replacing legitimate client installers on compromised servers to deliver malware to all connecting users. PostgreSQL and WordPress Elementor Pro each carry public proof-of-concept exploits enabling remote code execution.

TrueConf's two-CVE chain is the most operationally urgent event: an unauthenticated attacker reaching TCP port 4307 can invoke an undocumented function to run arbitrary scripts, then escape the sandbox to execute code as the host OS user. CISA added both CVEs to its KEV catalog with tight federal remediation deadlines of three days and two weeks, respectively. PostgreSQL's heap buffer overflow in to_char() requires only a standard authenticated database connection and has a public working PoC with confirmed code execution. Elementor Pro's unauthenticated file upload flaw — exploitable via a single crafted multipart HTTP request — is already being used in mass-exploit campaigns. Apache Tomcat's eleven-CVE batch includes authorization bypasses affecting 100% of the 187,461 observed internet-facing Tomcat instances. OpenSSL's nine-vulnerability advisory rounds out the week with denial-of-service and an AEAD authentication tag bypass, without confirmed active exploitation.

Filtered view of vendors with TrueConf - Aug2026 FocusTag® on the Black Kite platform.

TrueConf - Aug2026 (CVE-2026-72529, CVE-2026-72530)

What is this vulnerability?

TrueConf Server contains two critical vulnerabilities that are commonly chained to achieve pre-authenticated remote code execution on the host operating system. CVE-2026-72529 (CVSS 9.8, CWE-306) is a missing authentication vulnerability: an unauthenticated remote attacker with network access to TCP port 4307 — the TrueConf Server management port, open by default — can invoke an undocumented function and execute an arbitrary script in an isolated sandbox environment on the server. CVE-2026-72530 (CVSS 9.0, CWE-94) is a sandbox escape: an attacker who has already achieved script execution inside the sandbox can send a specially crafted script that breaks out of the isolated environment and executes arbitrary code on the underlying host system. Chained together in sequence — CVE-2026-72529 providing unauthenticated sandbox entry and CVE-2026-72530 providing host-level escape — the two vulnerabilities form a complete unauthenticated remote code execution attack path requiring no credentials. The vulnerabilities were discovered by Kaspersky ICS CERT researchers and affect all TrueConf Server versions since 2022: specifically 5.3.x through 5.3.9, 5.4.x through 5.4.9, and 5.5.x through 5.5.5. Fixed releases are 5.3.9, 5.4.9, and 5.5.5, released June 2026.

Both CVEs are confirmed as actively exploited in the wild by the Head Mare APT group, a hacktivist and destructive threat actor targeting organizations in Russia and Belarus. CISA added CVE-2026-72529 and CVE-2026-72530 to its Known Exploited Vulnerabilities (KEV) catalog on August 20, 2026, with mandatory federal agency remediation deadlines of August 23 and September 2, 2026 respectively. Kaspersky's incident response investigation documented a highly sophisticated post-exploitation chain: attackers used the initial TrueConf RCE to replace a TrueConf Server file with a web shell, then used that web shell to gather infrastructure intelligence, gain privileged database access, and — critically — replace the legitimate TrueConf client installer on the server with a trojanized version that deploys the PhantomCore backdoor to every user who downloads the client from the compromised server. This installer-replacement tradecraft extends the attacker's reach from the server to every endpoint in the organization that connects to the TrueConf Server platform for video conferencing.

Why should TPRM professionals care?

TrueConf Server is enterprise video conferencing and unified communications infrastructure — a platform that holds video meeting recordings, user account credentials, meeting room configurations, and privileged database access to all organizational communications data. The trojanized client installer vector is particularly dangerous from a supply chain risk perspective: a single compromised TrueConf Server becomes an active malware distribution platform for every employee who connects to it for their daily video meetings. TPRM professionals should treat this not merely as a server-side vulnerability requiring patch verification, but as a potential supply-chain compromise indicator requiring client-side incident response across the entire user population that may have downloaded a TrueConf client installer from the vendor's infrastructure. The CISA KEV listing with a three-day remediation deadline for CVE-2026-72529 signals the highest operational urgency classification.

What questions should TPRM professionals ask vendors?

Can you confirm if you have upgraded all instances of TrueConf Server to versions 5.3.9, 5.4.9, or 5.5.5 to mitigate the risk of CVE-2026-72529 and CVE-2026-72530?
Have you implemented measures to restrict access to TCP port 4307 until patching is complete, as recommended by TrueConf?
Have you conducted a post-compromise investigation to check for unauthorized web shells, modified server files, unexpected database access, and tampered client installers that may have distributed the PhantomCore backdoor to end users?
Can you confirm if you have notified users and validated the integrity of any TrueConf client packages downloaded from the affected server, as recommended by TrueConf in case a trojanized client installer may have been served?

Remediation recommendations

Upgrade TrueConf Server to 5.3.9, 5.4.9, or 5.5.5 immediately — the only complete remediation for both CVE-2026-72529 and CVE-2026-72530. No workarounds fully address either vulnerability. Both are CISA KEV entries with federal agency deadlines of August 23 (CVE-2026-72529) and September 2 (CVE-2026-72530).
Restrict TCP port 4307 to trusted internal networks immediately as an interim compensating control. This port is the primary attack surface for both vulnerabilities and is open by default. Blocking external access to this port eliminates the unauthenticated remote exploitation path while patching is scheduled.
Conduct a forensic integrity check of the TrueConf Server installation: compare all server files against the official TrueConf distribution, including client installer packages. Identify any web shells, modified binaries, or unexpected files in the server webapps and client distribution directories.
Notify all users who may have downloaded a TrueConf client installer from the server during the exposure window to verify their endpoint for PhantomCore indicators. Kaspersky has published PhantomCore IoCs; distribute these to endpoint security teams for scanning across the TrueConf user population.
Rotate all TrueConf Server service account credentials, database credentials, and any passwords or API keys accessible to the TrueConf application. The Kaspersky investigation confirmed privileged database access as part of the post-exploitation chain — treat all credentials known to the TrueConf process as potentially compromised on unpatched instances.

Black Kite's TrueConf - Aug2026 FocusTag® details critical insights on the event for TPRM professionals.

OpenSSL - Aug2026 (CVE-2026-18798, CVE-2026-63072, CVE-2026-63076, CVE-2026-75803, CVE-2026-63074, CVE-2026-63073, CVE-2026-54874, CVE-2026-14457, CVE-2026-63075)

What is this vulnerability?

OpenSSL released a security update on August 25, 2026 addressing nine vulnerabilities across all supported branches. Three are rated Moderate by the vendor and six are rated Low; eight of the nine lead to denial of service and one is an AEAD authentication integrity bypass. No remote code execution path exists in any of the nine. CVE-2026-18798 (CWE-415, Moderate) is the most operationally urgent: a double free in the QUIC server INITIAL packet handler causes heap corruption and server process termination when a malformed packet with a destination connection ID shorter than eight bytes is received. No authentication is required and a single packet is sufficient to trigger the crash against any internet-facing QUIC or HTTP/3 endpoint on OpenSSL 4.0, 3.6, or 3.5. CVE-2026-63072 (CWE-787, Moderate) is a deterministic 8-byte heap buffer overflow in CMS key unwrapping, reachable from the public CMS_decrypt() function by changing a single OID byte in a crafted CMS message. CVE-2026-63076 (CWE-476, Moderate) is an invalid pointer dereference in CMP password-based MAC verification that crashes a CMP server or client before any MAC is computed — no shared secret knowledge is required.

The six Low-severity issues cover a range of components. CVE-2026-75803 (CWE-354) is the most noteworthy among them despite its lower vendor rating: it is an AEAD authentication tag verification bypass in EVP_Cipher() for ChaCha20-Poly1305 and AES-OCB when an empty ciphertext is passed, allowing an application to accept forged messages — an integrity failure rather than a denial of service. CVE-2026-54874 gives a DTLS peer approximately 1,200x memory amplification through future-epoch record buffering. CVE-2026-63073 passes an attacker-controlled CMP sender distinguished name directly as a format string argument, crashing a CMP client. CVE-2026-63075 causes QUIC ACK-only packet metadata to accumulate indefinitely under adversarial traffic patterns. CVE-2026-63074 retains rejected CMP extraCerts indefinitely in long-lived server contexts. CVE-2026-14457 crashes TLS endpoints configured with Raw Public Keys (RPK) and no certificate under specific extension conditions. No public proof-of-concept has been published for any of the nine vulnerabilities and no exploitation in the wild has been confirmed. Fixed in OpenSSL 4.0.2, 3.6.4, 3.5.8, 3.4.7, and 3.0.22.

Why should TPRM professionals care?

OpenSSL is the cryptographic foundation beneath the majority of TLS, DTLS, and now QUIC implementations across internet infrastructure — embedded in web servers, email gateways, VPN clients, container images, cloud-native services, and operating system packages globally. A nine-CVE advisory covering QUIC, CMS, CMP, DTLS, RPK, and AEAD paths addresses vulnerabilities in the full breadth of OpenSSL's protocol surface simultaneously. The practical TPRM challenge is accurate scoping: CVE-2026-18798 is only exploitable in QUIC/HTTP/3 deployments on specific version branches, CVE-2026-63072 in S/MIME or CMS decryption applications, and the three CMP vulnerabilities exclusively in PKI automation stacks using CMP. CVE-2026-75803's AEAD bypass is particularly insidious because it does not cause availability failures — it is an integrity bypass that monitoring systems will not detect unless applications explicitly verify EVP_Cipher() authentication results for empty ciphertext cases. The six-way identical CISA-ADP CVSS score of 7.5 does not distinguish between these meaningfully different exposure profiles, so TPRM engagement must focus on confirming feature-specific exposure rather than CVSS ranking.

What questions should TPRM professionals ask vendors?

Have you upgraded your OpenSSL versions to 4.0.2, 3.6.4, 3.5.8, 3.4.7, or 3.0.22 to mitigate the risk of CVE-2026-18798, CVE-2026-63072, and CVE-2026-63076?
Can you confirm if you have reviewed your custom AEAD code for CVE-2026-75803, specifically checking if your application code calls EVP_Cipher() directly with ChaCha20-Poly1305 or AES-OCB?
Have you taken steps to restrict exposure of your QUIC, DTLS, and CMP endpoints to trusted networks until the OpenSSL update is deployed, as a measure to mitigate the risk of CVE-2026-54874 and CVE-2026-63074?
Can you confirm if you have inventoried your CMS and CMP usage to assess the impact of CVE-2026-63072 and the three CMP issues: CVE-2026-63076, CVE-2026-63073, and CVE-2026-63074?

Remediation recommendations

Apply the OpenSSL August 25, 2026 update to all systems running affected branches. Target versions: 4.0.2, 3.6.4, 3.5.8, 3.4.7, and 3.0.22. Premium support customers on legacy branches should move to 1.1.1zi and 1.0.2zr. Apply OS distribution security updates first — most production deployments receive OpenSSL via vendor-packaged updates, not direct builds.
Prioritize patching QUIC-facing systems running CVE-2026-18798-affected branches (4.0, 3.6, 3.5) as the highest urgency action within this advisory. CVE-2026-18798 is the only issue requiring no authentication and exploitable with a single packet against internet-accessible services.
Review application code that calls EVP_Cipher() directly with ChaCha20-Poly1305 or AES-OCB for CVE-2026-75803 exposure. This integrity bypass will not appear in availability monitoring — it is a silent authentication failure that must be identified by code audit and patching, not by runtime anomaly detection.
Inventory container images, serverless functions, and vendored dependencies for embedded OpenSSL versions. Container base images and statically linked applications frequently lag behind host-level package updates and are the most common source of missed OpenSSL patch exposure in complex environments.
Do not prioritize the nine CVEs by CVSS score alone. Six of the nine carry an identical CISA-ADP score of 7.5 that does not reflect the vendor's own Moderate/Low severity distinctions or feature-specific exposure. Prioritize by confirmed feature exposure: QUIC first, then CMS, then CMP, then DTLS, and review CVE-2026-75803 for application-level AEAD impact regardless of its Low vendor rating.

Black Kite's OpenSSL - Aug2026 FocusTag® details critical insights on the event for TPRM professionals.

Apache Tomcat - Aug2026 (Latest) (CVE-2026-65182, CVE-2026-68525, CVE-2026-68569, CVE-2026-65927, CVE-2026-65637, CVE-2026-65905, CVE-2026-66422, CVE-2026-65183, CVE-2026-68763, CVE-2026-66299, CVE-2026-73180)

What is this vulnerability?

Apache released a batch of eleven security fixes across Tomcat's supported branches (11.0, 10.1, 9.0) on August 25, 2026 — four rated CRITICAL and six HIGH in NIST NVD, with one MEDIUM. Internet-wide measurement prior to disclosure identified 187,461 exposed vulnerable Tomcat services, of which three of the eleven CVEs affect 100% of observed instances. The most significant vulnerabilities are authorization and authentication bypasses. CVE-2026-65182 (CVSS 9.1, CRITICAL) is a security constraint bypass triggered by constraint declaration order: when a longer-path constraint is declared before a more restrictive shorter sub-path constraint in web.xml, the longest-prefix matching logic applies the wrong constraint and the restrictive rule is silently skipped. This is a configuration-time bypass — an affected deployment is already serving requests without the intended authorization check rather than merely being exploitable. It affects all Tomcat versions back to 7.0.0, covering 100% of observed exposed services. CVE-2026-68525 (CVSS 9.1, CRITICAL) is an incorrect authorization bypass in FORM authentication redirect: the redirected request after successful login does not enforce method-specific security constraints. CVE-2026-68569 (CVSS 8.1, HIGH) causes DataSourceRealm principal lookup to fail open — a user absent from the realm is authenticated rather than rejected when CLIENT-CERT or SPNEGO authentication is in use.

CVE-2026-65637 (CVSS 9.8, CRITICAL) is an HTTP/2 strict SNI validation bypass arising from an incomplete fix for CVE-2026-32990 — making this the second attempt at the same code path. It carries the advisory's highest CVSS score but the narrowest exposure: only 5.7% of observed services run the sixteen affected builds (11.0.20-11.0.24, 10.1.53-10.1.57, 9.0.115-9.0.120). CVE-2026-65927 (CVSS 7.5, HIGH) is an off-by-one error in the RewriteValve [N] flag that skips the first rewrite rule on every restart — where the first rule is conventionally the most restrictive, this silently bypasses access controls. Three resource exhaustion issues — CVE-2026-68763 (HTTP/2 backlog leak), CVE-2026-66299 (WebSocket chat example buffer), and CVE-2026-65183 (Unix domain socket race condition) — round out the HIGH-severity group. Six of the eleven vulnerabilities were reported by the same research team (4ra1n, pyn3rd, unam4), concentrated in the security constraint and realm code paths, raising the likelihood of follow-up findings in the same area. The 8.5 and 7.0 branches (43.5% of all exposed services, 81,521 instances) are end of life and will not receive fixes. No exploitation in the wild has been confirmed. Fixed in Tomcat 11.0.25, 10.1.58, and 9.0.121.

Why should TPRM professionals care?

Apache Tomcat is the most widely deployed open-source Java application server — the runtime for web applications, REST APIs, enterprise Java EE services, and business-critical backend systems across virtually every industry vertical. Authorization bypasses in Tomcat's security constraint framework are particularly dangerous because they silently negate developer-declared access controls: a page declared as requiring authentication may be freely accessible to unauthenticated users without any error or indication. The measured exposure profile inverts the CVSS ranking in a TPRM-relevant way — the three vulnerabilities affecting 100% of exposed instances (CVE-2026-65182, CVE-2026-68525, CVE-2026-68569, CVSS 9.1/9.1/8.1) represent the widest practical impact, while the CVSS-9.8 CVE-2026-65637 affects only 5.7% of services. The 43.5% of observed Tomcat instances on end-of-life 8.5 or 7.0 branches carrying six to eight CVEs permanently with no available patch represent the most challenging TPRM finding: these assets require migration, not patching.

What questions should TPRM professionals ask vendors?

Have you upgraded all instances of Apache Tomcat to versions 11.0.25, 10.1.58, or 9.0.121 to mitigate the risk of vulnerabilities including CVE-2026-65182, CVE-2026-68525, and CVE-2026-68569?
Have you audited the security constraint ordering for CVE-2026-65182 to ensure that no longer-path constraints are declared before more restrictive constraints for shorter sub-paths, potentially leading to authorization gaps?
Can you confirm if you have discontinued the use of Apache Tomcat versions 8.5.x and 7.0.x, which are end of life and will not receive fixes for these vulnerabilities, and migrated to a supported branch?
Have you reviewed your authentication configurations to ensure that vulnerabilities such as CVE-2026-68569, CVE-2026-68525, and CVE-2026-65905, which require specific authenticators, are not a risk in your current setup?

Remediation recommendations

Upgrade all supported-branch Tomcat instances (9.0, 10.1, 11.0) to Tomcat 9.0.121, 10.1.58, or 11.0.25 immediately. These releases address all eleven CVEs. Verify the installed version post-upgrade and confirm through the Tomcat version utility.
Treat 8.5.x and 7.0.x instances as migration work, not patch work. No fix will be issued for these branches. These assets permanently carry between six and eight of the eleven CVEs and represent a 43.5% share of all observed exposure (81,521 services). Establish a migration timeline to a supported branch and treat migration completion as the only remediation outcome.
Audit web.xml security constraint declarations for CVE-2026-65182 independently of patching — this bypass may already be active in production configurations. Review every web.xml for cases where a constraint on a longer path precedes a more restrictive constraint on a shorter sub-path and treat any match as a live authorization gap requiring immediate correction.
Identify Tomcat instances that may be embedded within vendor products rather than independently administered. Measured exposure data shows implausibly large concentrations at specific historical versions (9.0.20 from 2019, 8.5.53, 7.0.56), consistent with Tomcat bundled inside appliances or commercial applications. For these assets the remediation path is a vendor product update, not a direct Tomcat upgrade.
Remove the Tomcat examples web application (`/examples/`) from all production instances. CVE-2026-66299 targets the bundled WebSocket chat example in the examples webapp. Removing examples is standing Tomcat security guidance and eliminates this attack vector entirely.

Black Kite's Apache Tomcat - Aug2026 (Latest) FocusTag® details critical insights on the event for TPRM professionals.

PostgreSQL - Aug2026 (CVE-2026-14669)

What is this vulnerability?

CVE-2026-14669 (CVSS 8.8, CWE-122) is a heap-based buffer overflow in PostgreSQL's to_char(timestamptz) function, addressed in the PostgreSQL August 13, 2026 security update. The vulnerability resides in the datetime_to_char_body() internal implementation: the function correctly sizes its working buffer based on the format string length, but when processing timezone format codes (TZ, TZtz), it copies the session's user-controlled POSIX timezone abbreviation into that buffer without enforcing a length check. An authenticated database user can set an oversized POSIX timezone abbreviation and invoke to_char() with a timezone format code to trigger a heap overflow. A public proof-of-concept exploit published by V12 Security on GitHub chains this heap overflow into full arbitrary code execution as the operating system user running the PostgreSQL server process — typically the postgres OS account. The PostgreSQL security advisory explicitly confirms that exploits leading to code execution have been reported. The attack requires only a standard authenticated database connection with access to the to_char() function — no DBA role, no administrative privileges, and no special configuration beyond a normal database user account. CVE-2026-14669 affects PostgreSQL versions 14 through 18 prior to their respective patched releases (14.24, 15.19, 16.15, 17.11, 18.5) across all five currently supported major branches. Versions 13 and earlier are not affected.

The V12 Security PoC demonstrates the full exploit chain: two adjacent to_char() calls reuse the same freed workspace hole; the second overflow rewrites the first result's varlena length, causing binary COPY output to disclose approximately 16 KB of adjacent heap containing function pointers that reveal the PostgreSQL PIE base; a subsequent to_char('TZtz') call corrupts allocator metadata to overwrite printtup's per-row memory context, install a fake MemoryContextCallback pointing to system(), and execute the configured command when MemoryContextReset() is called at row end. While the published PoC targets a specific pinned build with build-specific offsets, the underlying heap overflow primitive is present across all affected versions. No active exploitation has been confirmed at time of disclosure and CVE-2026-14669 has not been added to CISA's KEV catalog, though the PostgreSQL team's own confirmation of code execution exploits reported to them raises the operational severity beyond the KEV classification alone.

Why should TPRM professionals care?

PostgreSQL is the world's most widely deployed open-source relational database management system — the backend data store for web applications, SaaS platforms, financial systems, healthcare records, and government infrastructure globally. Code execution as the PostgreSQL OS service account grants the attacker direct access to every database, schema, and table on the instance; application credentials and secrets stored in the database; PostgreSQL configuration files and server TLS certificates; and in cloud or containerized deployments, potentially broader access to secrets mounted into the PostgreSQL container environment. The low authentication prerequisite — any standard database user who can invoke to_char() — means that application-level database accounts used by web applications are sufficient attack vectors if the application's database connection credentials are compromised. TPRM professionals must confirm patch status across all five affected major version branches, as the breadth of affected releases means organizations with mixed PostgreSQL version environments may have partially patched and partially exposed database infrastructure.

What questions should TPRM professionals ask vendors?

Have you upgraded all instances of PostgreSQL to the patched release corresponding to the deployed major version: 18.5 for 18.x, 17.11 for 17.x, 16.15 for 16.x, 15.19 for 15.x, or 14.24 for 14.x, to mitigate the risk of CVE-2026-14669?
Have you implemented monitoring for unexpected errors in to_char() or timezone processing in your PostgreSQL server logs that may indicate overflow-triggering attempts?
Can you confirm if you have restricted or audited the use of POSIX timezone strings in application queries as a temporary partial mitigation for CVE-2026-14669?
Have you reviewed all database users and connection strings to ensure application accounts operate with the minimum required privileges, specifically in relation to date/time formatting functions, to detect and prevent potential exploitation of CVE-2026-14669?

Remediation recommendations

Upgrade all PostgreSQL instances to the patched release for their major version branch: 14.24, 15.19, 16.15, 17.11, or 18.5. The August 2026 update addresses CVE-2026-14669 alongside additional overflow bugs — apply the complete update package rather than cherry-picking individual fixes. Verify the running version post-upgrade with `SELECT version();`.
Given the availability of a public PoC with confirmed code execution, treat patch deployment as an emergency action. Do not rely on network controls as a substitute for version upgrade — authenticated application connections are the exploitation path, and legitimate application database accounts provide sufficient access to trigger the vulnerability.
Evaluate revoking EXECUTE privilege on to_char() for application accounts that do not require timestamp-to-string formatting as an interim mitigation if immediate upgrade is not possible. Additionally, restrict or audit the use of POSIX timezone strings in application queries. These measures narrow the attack surface but are not substitutes for patching.
Review PostgreSQL server logs for unexpected process spawning from the postgres OS user, unusual filesystem access outside the PostgreSQL data directory and log directories, and anomalous outbound network connections from the database server host. The PoC invokes system() from within the PostgreSQL backend process — OS-level process monitoring can detect unexpected child process creation from the postgres user.
Include PostgreSQL container images in the patch scope. Many production PostgreSQL deployments run in containers or Kubernetes pods using base images that lag behind the upstream package repository by days to weeks. Update container images to pull from updated PostgreSQL official images or rebuild from updated Debian/Alpine base layers.

Black Kite's PostgreSQL - Aug2026 FocusTag® details critical insights on the event for TPRM professionals.

WordPress Elementor - Aug2026 (CVE-2026-32475)

What is this vulnerability?

CVE-2026-32475 (CVSS 9.0, CWE-434) is a critical unauthenticated arbitrary file upload vulnerability in the Elementor Pro WordPress plugin, addressed in Elementor Pro version 4.2.2 released August 19, 2026. All Elementor Pro versions 4.2.1 and earlier are affected. The vulnerability resides in the Forms module's File Upload field, implemented in modules/forms/fields/upload.php, where two independent loops handle uploaded files with different logic for empty multipart file entries — a loop desynchronization flaw. The validation() loop exits the entire method via a return statement when the first file entry has an empty filename (UPLOAD_ERR_NO_FILE) and the field is not marked Required. The process_field() loop handles the same empty first entry with a continue statement, skipping only that entry and proceeding to move subsequent files to the public web-accessible destination directory. An attacker submits a two-part multipart upload: an empty first file entry followed by a PHP webshell. The validator exits after the empty entry without ever checking the PHP file; the file mover skips the empty entry and moves the PHP file into wp-content/uploads/elementor/forms/, a publicly accessible directory. The PHP file is then directly requestable via HTTP to trigger server-side code execution.

The attack requires no authentication, no credentials, no WordPress account, and no nonce. All parameters needed to craft the exploit request — post_id, form_id, and the upload field's input name — are visible in plain HTML to any anonymous visitor of any page containing an Elementor Form with a File Upload field. Filename recovery to request the uploaded webshell requires only brute-forcing five microsecond-encoding hex digits from PHP's time-based uniqid() output, or zero brute-force in configurations where the form's email autoresponder discloses the uploaded file URL. A public PoC is available, discovered and reported by Tin Pham (TF1T) of VietSunshine Cyber Security Services and coordinated via Patchstack. Patchstack has categorized this vulnerability as used in mass-exploit campaigns targeting thousands of websites regardless of traffic volume or perceived target value. The fix in version 4.2.2 brings both loops into agreement on empty-entry handling and adds a redundant extension blocklist check directly inside process_field() at the file-move sink, ensuring the blocklist guards the execution path regardless of validator state.

Why should TPRM professionals care?

Elementor Pro is one of the most widely deployed premium WordPress page builder plugins globally, used across millions of e-commerce, media, government, and enterprise web properties. The attack prerequisite — at least one published Elementor page containing a Form widget with a File Upload field — is an extremely common configuration used universally for job applications, customer contact forms, support ticket submissions, and document upload portals. The full attack chain — HTTP discovery of form parameters, unauthenticated upload, filename derivation, webshell request — is executable from a single automated script with no interactive steps, making mass-exploit automation trivially scalable to the full global Elementor Pro deployment footprint. From a TPRM perspective, a PHP webshell in wp-content/uploads/elementor/forms/ provides an attacker with the same capabilities as a full web server compromise: code execution with web server privileges, access to WordPress database credentials in wp-config.php, the ability to exfiltrate stored customer data, create backdoor WordPress administrator accounts, and pivot laterally to systems reachable from the web server's network position. Patchstack's mass-exploit campaign classification means TPRM professionals should assume that unpatched Elementor Pro instances have been or will be targeted regardless of their organization's prominence.

What questions should TPRM professionals ask vendors?

Can you confirm if you have updated all instances of the Elementor Pro WordPress plugin to version 4.2.2 or later to mitigate the risk of CVE-2026-32475?
Have you audited the directory wp-content/uploads/elementor/forms/ for any webshells or files with PHP or other executable extensions that do not correspond to legitimate document or image uploads?
Have you implemented the Patchstack virtual patching mitigation rule that blocks exploitation attempts against this vulnerability if the plugin cannot be upgraded right away?
Have you reviewed your web server access logs for unexpected GET requests to files in wp-content/uploads/elementor/forms/ with .php extensions, unexpected PHP process execution originating from the webapps directory, unusual outbound network connections from the web server process, and new WordPress administrator accounts created outside normal workflows?

Remediation recommendations

Update Elementor Pro to version 4.2.2 or later immediately and treat this as an emergency patching action given the public PoC and confirmed mass-exploit campaign activity. The fix is available through the standard WordPress admin dashboard plugin update flow. Enable auto-updates for this plugin via Patchstack if available, or through WordPress automatic plugin updates.
Immediately audit wp-content/uploads/elementor/forms/ for any PHP or executable-extension files that do not correspond to legitimate document or image uploads. Specifically look for files with .php, .php3, .php4, .php5, .php7, .phtml, .asp, .aspx extensions. Any such files represent successful prior exploitation and require full incident response: determine execution history, identify any backdoor admin accounts created, assess database credential and customer data exposure.
Activate Patchstack virtual patching as an immediate compensating control for any Elementor Pro deployment that cannot be immediately upgraded to 4.2.2. Patchstack's mitigation rule blocks exploitation attempts against the specific two-part multipart upload attack pattern without requiring a code change.
Review WordPress administrator accounts on all Elementor Pro sites for unexpected accounts created after the vulnerability's August 19, 2026 disclosure date. Post-exploitation webshell deployment commonly includes creation of backdoor admin accounts to maintain access. Any unexpected admin accounts should be treated as indicators of compromise.
Establish WordPress plugin update monitoring as an ongoing TPRM vendor assessment requirement. Elementor Pro joins a pattern of high-severity vulnerabilities in widely deployed WordPress plugins — the mass-exploit campaign model means that any critical plugin flaw receives automated exploitation attempts within hours of PoC publication, making a 72-hour patch SLA for critical WordPress plugin updates essential operational hygiene.

Black Kite's WordPress Elementor - Aug2026 FocusTag® details critical insights on the event for TPRM professionals.

How TPRM Professionals Can Leverage Black Kite for These Vulnerabilities

This week's five FocusTags® illustrate two distinct exploitation profiles that TPRM programs must address simultaneously. The first profile — TrueConf with CISA KEV, Head Mare APT, and trojanized client installer distribution — represents state-level threat actor exploitation of enterprise communication infrastructure with supply chain propagation capability. The second — Elementor Pro mass-exploit campaigns, PostgreSQL public PoC, and Apache Tomcat's 100%-coverage authorization bypasses — represents broad-spectrum automated exploitation of widely deployed web and database infrastructure.

TrueConf's installer-replacement tradecraft is a particularly important TPRM signal: a single compromised vendor's TrueConf Server becomes an active malware distribution platform for every employee of that vendor who uses TrueConf for daily communications. FocusTags® identify vendors with internet-accessible TrueConf deployments and generate structured vendor engagement that includes not just patch verification but also client-side IoC assessment — extending the TPRM response to cover the full supply chain impact.

• Exposure-Weighted Prioritization: Apache Tomcat's authorization bypasses affect 187,461 exposed services at 100% coverage — a measured exposure signal that CVSS scores alone cannot surface. FocusTags® correlate CVE severity with real-world deployment breadth to identify the highest-impact vendor engagement priorities.

• Supply Chain Compromise Detection: TrueConf's installer-replacement tradecraft extends the breach from server to endpoint across an organization's entire TrueConf user base. FocusTags® surface this lateral impact in vendor engagement questions, covering both server-side patch verification and client-side compromise assessment.

• PoC-Driven Urgency Calibration: PostgreSQL and Elementor Pro each carry working public PoCs confirmed to produce code execution. FocusTags® treat PoC publication as an immediate engagement trigger equivalent to confirmed exploitation, ensuring vendor response timelines match the actual exploitation risk rather than advisory publication dates.

• Configuration-Dependent Exposure Assessment: OpenSSL's nine CVEs each require different feature configurations to be exploitable — QUIC, CMS, CMP, DTLS, RPK, or AEAD-specific code paths. Apache Tomcat's auth bypasses depend on specific authenticator types and constraint declaration patterns. FocusTags® vendor questions embed these configuration checks for accurate exposure determination.

Strengthening TPRM Outcomes with Black Kite’s FocusTags®

Black Kite's FocusTag® technology delivers actionable TPRM intelligence across the full vulnerability spectrum — from nation-state exploitation with CISA KEV urgency, to public PoC-driven database and web server risks, to hundred-thousand-instance authorization bypass coverage — with vendor-specific engagement guidance for each threat profile.

• Automated Vendor Scoring: FocusTags® automatically update vendor risk scores for all vendors detected with internet-accessible TrueConf, OpenSSL-dependent services, Tomcat instances, PostgreSQL endpoints, or WordPress Elementor deployments — no manual assessment effort required across a five-tag week.

• Structured Vendor Engagement: Each FocusTag® generates structured vendor questions tailored to the specific vulnerability's exploitation path — TrueConf client installer integrity, OpenSSL QUIC and CMS feature exposure, Tomcat EOL branch migration status, PostgreSQL to_char() privilege auditing, and Elementor upload directory webshell assessment.

• TPRM-Contextualized Analysis: Every FocusTag® assessment extends beyond patch status to evaluate the full third-party breach scenario — including supply chain lateral impact (TrueConf), mass-exploit campaign exposure (Elementor), and permanently unpatched EOL branch risk (Apache Tomcat 8.5/7.0).

About Focus Friday

Every week, we delve into the realms of critical vulnerabilities and their implications from a Third-Party Risk Management (TPRM) perspective. This series is dedicated to shedding light on pressing cybersecurity threats, offering in-depth analyses, and providing actionable insights.

FocusTags® in the Last 30 Days

TrueConf - Aug2026: CVE-2026-72529, CVE-2026-72530, Unauthenticated Pre-Authentication Remote Code Execution via Chained Missing Authentication and Sandbox Escape Vulnerabilities in TrueConf Server, Actively Exploited by Head Mare APT (CISA KEV).
OpenSSL - Aug2026: CVE-2026-18798, CVE-2026-63072, CVE-2026-63076, and 6 additional CVEs, Denial-of-Service and AEAD Authentication Tag Bypass Vulnerabilities in QUIC, CMS, CMP, DTLS, RPK, and AEAD Components of OpenSSL.
Apache Tomcat - Aug2026 (Latest): CVE-2026-65182, CVE-2026-68525, CVE-2026-68569, CVE-2026-65637, and 7 additional CVEs, Multiple Authentication and Authorization Bypass Vulnerabilities in Apache Tomcat Affecting 187,461 Exposed Internet-Facing Services.
PostgreSQL - Aug2026: CVE-2026-14669, Heap-Based Buffer Overflow in to_char(timestamptz) Enabling Authenticated Remote Code Execution as OS User in PostgreSQL (Public PoC Available).
WordPress Elementor - Aug2026: CVE-2026-32475, Unauthenticated Arbitrary File Upload to Remote Code Execution via Loop Desynchronization in Elementor Pro WordPress Plugin (Mass-Exploit Campaigns Active).
Citrix NetScaler - Aug2026: CVE-2026-8452, Pre-Authentication Memory Overflow in SAML Signature Canonicalization enabling Remote Code Execution as Root in NetScaler ADC and NetScaler Gateway.
VMware vCenter - Aug2026: CVE-2026-59309, CVE-2026-59310, Authentication Bypass in VMware Directory Service and Directory Traversal RCE in vCenter Syslog Server enabling Unauthenticated Full vCenter Takeover.
Zimbra - Aug2026: CVE-2026-73570, Unauthenticated SNMP Command Injection enabling Arbitrary OS Command Execution as zimbra User in Zimbra Collaboration Suite.
Oracle WebLogic - Aug2026: CVE-2026-60702, and 7 additional CVEs (CVSS up to 9.9), Multiple Unauthenticated Remote Code Execution and Takeover Vulnerabilities via T3 and IIOP in Oracle WebLogic Server.
Roundcube - Aug2026: No CVE, Remote Code Execution via markasjunk Plugin cmd_learn Driver and Server-Side Request Forgery Bypass Vulnerabilities in Roundcube Webmail.
Water Sector Campaign: CVE-2017-16740, Active Cyber Campaign Targeting Internet-Facing Rockwell MicroLogix PLCs Causing Operational Disruptions at U.S. Water and Wastewater Utilities.
Metabase: CVE-2026-72898, Unauthenticated SQL Injection via /api/session/reset_password enabling Full Administrator Takeover in Metabase Business Intelligence Platform.
Cisco ASA & FTD - Aug2026: CVE-2026-20349, Unauthenticated Denial of Service via Crafted HTTP Request to Remote Access SSL VPN Service in Cisco Secure Firewall ASA and FTD.
Cisco IMC - Aug2026: CVE-2026-20200, CVE-2026-20288, Argument Injection via SSH Public Key Retrieval Feature enabling Low-Privilege to Root Escalation in Cisco Integrated Management Controller.
Cisco IOS XE - Aug2026: CVE-2026-20272, CVE-2026-20267, and 5 additional CVEs, Multiple Critical and High-Severity Vulnerabilities including Command Injection and Authentication Bypass in Cisco IOS XE Software.
Adobe ColdFusion - Aug2026: CVE-2026-48362, and 14 additional CVEs (CVSS up to 10.0), Multiple Critical Remote Code Execution and Deserialization Vulnerabilities in Adobe ColdFusion.
SharePoint - Aug2026: CVE-2026-63520, CVE-2026-66808, and 13 additional CVEs, Multiple Deserialization and Unauthenticated Remote Code Execution Vulnerabilities in Microsoft SharePoint Server.
Exchange Server - Aug2026: CVE-2026-62912, CVE-2026-65813, and 5 additional CVEs, Multiple Remote Code Execution and Privilege Escalation Vulnerabilities in Microsoft Exchange Server.
ClamAV - Aug2026: CVE-2026-20337, CVE-2026-20338, and 5 additional CVEs, Multiple ZIP Parser and File Processing Denial of Service Vulnerabilities in ClamAV Antivirus Engine.
pgAdmin - Aug2026: CVE-2026-17566, CVE-2026-17349, CVE-2026-17351, CVE-2025-13780, CVE-2026-12045, Remote Code Execution via Unsafe Deserialization and Multiple Critical Vulnerabilities in pgAdmin 4.
Django - Aug2026: CVE-2026-15307, CVE-2026-15920, CVE-2026-15337, CVE-2026-15830, Remote Code Execution and Multiple High-Severity Vulnerabilities in Django Web Framework.
Jenkins - Aug2026: CVE-2026-70426, JEP-200 Deserialization Filter Bypass enabling Remote Code Execution in Jenkins Automation Server.
TeamCity - Jul2026: CVE-2026-63077, Unauthenticated Authentication Bypass via Agent Polling Protocol leading to Remote Code Execution in JetBrains TeamCity On-Premises.
Cisco FMC - Jul2026: CVE-2026-20316, CVE-2026-20079, Static Credential Authentication Bypass and Critical Authentication Bypass (CVSS 10.0) leading to Root Execution in Cisco Secure Firewall Management Center.
SolarWinds WHD - Aug2026: CVE-2026-28323, CVE-2026-28299, SAML Authentication Bypass and Denial of Service Vulnerability in SolarWinds Web Help Desk.
N-central - Aug2026: CVE-2026-18577, CVE-2026-18556, Authentication Bypass via Alternate Path leading to Full Account Takeover and RMM-Level Access in N-able N-central.
Langflow - Aug2026: CVE-2026-9198, Unauthenticated Superuser Token Minting via /api/v1/auto_login enabling Remote Code Execution in Langflow.
Apache Tomcat - Aug2026: CVE-2026-34486, CVE-2026-29146, EncryptInterceptor Bypass enabling Unauthenticated Remote Code Execution via Java Deserialization in Apache Tomcat Clustering.
Gitea - Aug2026: CVE-2026-59774, Org-mode #+INCLUDE Path Traversal enabling Arbitrary File Read and Remote Code Execution in Gitea.
WordPress - wp2shell : CVE-2026-63030, CVE-2026-60137, REST API Batch-Route Confusion Vulnerability and SQL Injection Vulnerability Leading to Unauthenticated Remote Code Execution in WordPress Core.
NGINX - Jul2026 : CVE-2026-42533, CVE-2026-60005, CVE-2026-56434, Heap-Based Buffer Overflow Vulnerability, Uninitialized Memory Access Vulnerability, and Use-After-Free Vulnerability in NGINX.
SolarWinds Serv-U - Jul2026 : CVE-2026-28302, CVE-2026-28304, CVE-2026-28305, CVE-2026-28306, CVE-2026-28307, CVE-2026-28308, CVE-2026-28309, CVE-2026-28310, CVE-2026-28311, CVE-2026-28312, CVE-2026-28313, CVE-2026-28314, CVE-2026-28315, CVE-2026-28316, CVE-2026-28317, CVE-2026-28321, Insecure Direct Object Reference, Privilege Escalation, Remote Code Execution, Broken Access Control, and Stored Cross-Site Scripting Vulnerabilities in SolarWinds Serv-U.
Oracle WebLogic - Jul2026 : CVE-2026-60206, CVE-2026-60205, CVE-2026-60204, CVE-2026-60202, CVE-2026-60198, CVE-2026-60294, CVE-2026-60200, CVE-2026-60291, CVE-2026-60292, CVE-2026-60199, CVE-2026-60208, Unauthenticated Remote Code Execution and Unauthorized Data Access Vulnerabilities in Oracle WebLogic Server.
Zimbra - Jul2026 (Latest) : No CVE, Command Injection Vulnerability in SNMP Monitoring Component and Cross-Site Scripting Vulnerabilities in Zimbra Collaboration Suite Classic Web Client.
Exim Mail - Jul2026 : GCVE-25-2026-07-45-1, Local Directory Traversal Vulnerability Leading to Privilege Escalation in Exim Mail Transfer Agent.