Weekly Cybersecurity Summary 21 August to 27 August 2026

The Heart Internet Team are aware of several security issues affecting web hosting infrastructure this week, and we want to help website owners and administrators understand what they mean, who may be affected, and what sensible steps to take. This week’s issues span two widely used WordPress plugins and an unfolding situation at Plesk, one of the control panels used to manage websites on our platform. Between them, the common thread is account takeover: each issue could let an attacker gain administrator-level access to a site or server if left unpatched.

Pods is a popular WordPress plugin used to build custom content types and fields, installed on more than 100,000 sites. Security researcher Nhien Pham found that the plugin’s admin AJAX router had a broken authorisation check: a helper function meant to block unauthorised requests could be tricked into returning a value that let the check pass anyway. Wordfence assigned the flaw CVE-2026-19598 and disclosed it on 24 August 2026 after coordinating with the Pods team. The root cause is straightforward once explained: the router relied on a single function call to decide whether a request was allowed, and that function could return false (allowed) when it should have returned an error and stopped the request outright.

On shared hosting, this is exactly the kind of flaw that turns one vulnerable site into a platform-wide risk if plugins aren’t kept current, since an attacker who takes over one WordPress installation can use it as a foothold to probe neighbouring accounts. On VPS and dedicated servers, the exposure is contained to whichever sites run Pods, but a compromised WordPress admin account on those servers can still be used to install further malware or pivot into other services running alongside it.

Update the Pods plugin to 3.3.9.1 or later (or the relevant backport) immediately. There is no practical workaround short of deactivating the plugin.

The miniOrange SAML 2.0 Single Sign-On plugin lets WordPress sites authenticate users against an external identity provider. Both flaws were originally patched by miniOrange in July 2026, but DigitalOcean and the security firm Patchstack reported on 25 August 2026 that attackers are now actively exploiting them in the wild, including a compromised admin session DigitalOcean blocked on 16 August. CVE-2026-61979 is a signature algorithm confusion bug: the plugin trusted whichever signature algorithm the incoming SAML response claimed to use, so an attacker could downgrade a strong RSA signature check to a weaker HMAC one they could forge themselves. CVE-2026-15981 is a subtler coding mistake: PHP’s signature-verification function can return 1 (valid), 0 (invalid) or -1 (an OpenSSL error), but the plugin treated any non-zero result as “valid” — so a malformed signature that triggered an OpenSSL error was wrongly accepted. Chained together, either flaw lets an attacker log in as any user, including an administrator, without knowing a password.

This is a reminder that “already patched months ago” doesn’t mean “no longer a risk” — these bugs were fixed in July but are only now being exploited at scale, so any site still running an old build remains exposed regardless of when the fix became available. Shared hosting environments using this plugin for single sign-on should treat this as urgent, since a compromised SSO login effectively hands over the WordPress admin panel. VPS and dedicated customers running their own identity setups should check whether any site uses this plugin, as it’s easy to lose track of smaller SSO integrations over time.

Verify all installations are on the July 2026 patched release or later. If you administer sites using this plugin, review admin user lists and login logs for the period since mid-August for unrecognised accounts or sessions.

Plesk emailed website owners and administrators on 27 August 2026 to say a security patch addressing “a vulnerability across versions of Plesk, including fixes for vulnerability rated up to critical severity” was expected to be released that same day. The advisory names Plesk for Linux and Windows versions 18.0.34 to 18.0.79.8 and 18.0.80 to 18.0.80.4 as affected, which covers effectively every currently supported build. As of this summary, Plesk had not yet published the CVE identifier, the technical root cause, or the specific patched build number; that detail was promised in a follow-up advisory once the patch is live. This is the sixth emergency Plesk security patch users have seen in roughly a month, following a run of vulnerabilities including an authentication bypass allowing reseller-to-root privilege escalation (CVE-2026-64637) and a blind SQL injection flaw (CVE-2026-64636), both disclosed in early August.

Because Plesk runs with elevated privileges to manage websites, databases, mail and DNS on a server, a critical-severity flaw here has the potential to affect every site hosted under that panel, on both shared and dedicated Plesk servers. Given the pace of recent Plesk advisories, we’d rather flag this while it’s still developing than wait for full technical detail.

Watch for Plesk’s technical advisory and apply the update to all Plesk servers as soon as it’s published, rather than waiting for a routine maintenance window.

If you run Pods or miniOrange SAML SSO and are concerned you may already have been affected, a few checks are worth doing:

If you have questions about any of the issues covered in this summary, or need help checking whether your account is affected, our support team is here to help. You can raise a support ticket via the Customer Area at heartinternet.uk, or use live chat, available Monday to Friday, 09:30 to 16:00. You can also find general guidance in our knowledge base at heartinternet.uk/support. We’re happy to help you work through any of the checks above if you’re not sure where to start.