💥 BREACHES & INCIDENTS
- Gyazo server flaw exploited to steal 23.6 million user records
Hackers exploited a Gyazo server vulnerability to steal 23.6 million user records and 490 million image metadata records.- Gyazo, the cloud screenshot/screen-recording platform run by Helpfeel with ~23 million users, especially popular in gaming communities, was breached on September 11, 2026.
- Stolen user data may include names/nicknames, email addresses, password hashes, user and device IDs, login session IDs, X integration tokens, Google SSO emails, profile details, subscription and billing info, and usage statistics.
- Attackers also took 490 million image metadata records (mostly pre-January 2019 uploads), including upload IP addresses, User-Agent strings, EXIF location data, OCR-extracted text, image titles, source URLs, and hashed passphrases for private images.
- The breach occurred via a server vulnerability that Gyazo fixed on September 12 after detecting suspicious activity; the company also obtained a list of private images and cannot rule out that some were viewed.
- Gyazo has taken the platform offline for maintenance, disabled access to exposed files, and is notifying affected users while investigating with external experts; no data deletion or impact to Helpfeel/Cosense services was found.
🕵️ RESEARCH & DEEP DIVES
- Click2Shell: WordPress Core flaw chained with theme bug enables RCE via one malicious link
Researchers disclosed Click2Shell, a WordPress exploit chain that turns a single malicious link into remote code execution.- Affects WordPress sites running versions before 7.1.1, which fixed the Core theme-preview flaw on September 17, 2026
- The Core weakness silently installs an attacker-selected WordPress.org theme via jQuery selector injection in the theme installer route, requiring only a logged-in administrator to visit a crafted URL
- Chained with insecure pre-activation code in themes like Mobile Repair Zone 2.5.4, whose unauthenticated AJAX handler downloads and executes attacker-supplied PHP for full RCE
- Compromise exposes wp-config.php, database credentials, site data, and potentially the wider hosting environment
- Standalone flaw rated High (CVSS 7.1); full chain rated Critical; no CVE assigned yet and no evidence of exploitation in the wild
Sources 📄 Source: pwn.ai · 📎 Coverage: cybersecuritynews.com · 👁 via Cyber Security News, cryptika.com (discovered)
🔓 CVEs & KEV
CVE-2026-84434 — Gravity Forms — CVSS 9.8 — Gravity Forms through 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden F...
CVE-2026-89274 — brechtvds WP Recipe Maker — CVSS 9.1 — WP Recipe Maker through 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via...
CVE-2026-92229 — wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder — CVSS 9.1 — Forminator Forms through 1.57.2 - Unauthenticated Arbitrary Shortcode Execution vi...
CVE-2026-92807 — pdfcrowd Save as PDF Plugin by PDFCrowd — CVSS 8.8 — Save as PDF Plugin by PDFCrowd through 4.6.1 - Authenticated (Contributor+) Arbitr...
CVE-2026-87909 — opajaap WP Photo Album Plus — CVSS 7.5 — WP Photo Album Plus through 9.2.09.002 - Authenticated (Subscriber+) Remote Code E...
CVE-2026-13354 — gabelivan Asset CleanUp: Page Speed Booster — CVSS 7.2 — Asset CleanUp: Page Speed Booster through 1.4.0.5 - Unauthenticated Stored Cross-S...
CVE-2026-89334 — wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots — CVSS 6.5 — Better Messages through 2.15.33 - Missing Authorization to Authenticated (Custom+)...
CVE-2026-15760 — Divi Essential Divi Essentials — CVSS 6.5 — Divi Essentials through 5.8.1 - Missing Authorization to Authenticated (Subscriber...
CVE-2026-92967 — wppochipp Pochipp — CVSS 6.1 — Pochipp through 1.20.2 - Reflected Cross-Site Scripting via 'keyword' ParameterThe...
📋 ADVISORIES
📄 Source for BragJack Attack Lets Malicious Extensions Hijack AI Agents Across 5 Major Browsers — forever.security
📄 Source for Tutor LMS plugin flaws (CVE-2026-88944, CVE-2026-89081, CVE-2026-89333) affect WordPress sites — wordfence.com