Security Advisory - Published 2026-06-16 - WordPress Patchstack Batch

WordPress June 16 Patchstack CVEs: patch the plugin first, then check users, files, and logs

This batch adds 40 high and critical WordPress plugin CVEs from the latest Ping7 monitor run. The affected plugins include ecommerce, forms, maps, forums, galleries, redirects, user management, booking, travel, and automation integrations.

Fast triage

• Search the plugin list for the product names below, including disabled folders left under `wp-content/plugins`.
• Patch supported plugins. Remove abandoned or unused plugins instead of leaving old code in place.
• For SQL injection: preserve web and database logs, then review unusual requests and database errors.
• For PHP object injection or RCE: review recently changed files, cron jobs, new users, and plugin settings.
• For file upload, path traversal, or file deletion: inspect uploads, backups, media paths, and access logs before cleanup.

Affected plugins

Owner self-check

wp plugin list --fields=name,version,status
find wp-content/plugins -maxdepth 2 -type f -mtime -7 | egrep '\\.php$|\\.zip$|\\.phar$|\\.phtml$'
find wp-content/uploads -type f -mtime -7 | egrep '\\.php$|\\.phtml$|\\.phar$|\\.zip$|backup|invoice|export'
grep -R "CVE-2026\\|sql\\|fatal\\|unserialize\\|permission\\|upload\\|download" wp-content/debug.log 2>/dev/null

On managed hosting, use the file manager and WordPress admin pages if shell access is unavailable. Record plugin versions and timestamps before deleting files, because the repair report needs the sequence of events.

Clean result

• No affected plugin remains below the fixed vendor version.
• No unknown administrator, shop manager, editor, subscriber, or integration account was added after the disclosure window.
• No new PHP-like file appears in uploads, cache, plugin, theme, mu-plugin, or backup directories.
• No unexplained order, invoice, form, booking, user, redirect, or forum changes appear in logs.
• Payment, CRM, email-marketing, and form integration keys are rotated if suspicious access cannot be ruled out.

When to use Ping7 repair

Use Ping7 CVE Repair when the affected plugin is present, the site has payment or form data, the plugin cannot be updated safely, logs are noisy, or unknown files/users appear. Send the domain, plugin version, hosting type, and the first suspicious timestamp.

References

• Patchstack vulnerability database
• CVE Program records
• Ping7 CVE lookup

Author: Ping7 security team - Published: 2026-06-16 - WordPress Patchstack batch - Defensive self-check only.