Cybersecurity threats target Roundcube and WordPress platforms

Security researchers and government agencies have issued warnings regarding the active exploitation of high-severity vulnerabilities in widely used web platforms.

The Canadian Centre for Cyber Security reported that threat actors are exploiting CVE-2026-48842, an SQL injection vulnerability in the Roundcube open-source webmail client. The flaw, which carries a CVSS score of 8.1, exists in the virtuser_queryplugin. Attackers can bypass security filters to manipulate database operations, potentially gaining access to user identities, messages, and address books. Roundcube has released fixes in versions 1.6.16 and 1.7.1.

Separately, a critical path traversal vulnerability (CVE-2026-87902) has been identified in WordPress Core. This flaw, rated with a severity of 8.1, allows unauthenticated attackers to include local PHP files, which can lead to remote code execution (RCE) under specific configurations. Because WordPress powers a significant portion of the internet, researchers urge administrators to update to version 7.1.2 or higher immediately to prevent full website takeovers.