Short answer: Take one ordinary month — May 2026 — and walk up the stack that every website is built from. The CMS, the framework, the language, the store software, the web server, the control panel, the packages your developer installs: in that single month, every one of those layers shipped a serious security hole. Some were critical and usable with no login at all; three were already being attacked. This isn’t a “WordPress problem” — it’s a whole-web problem, and “I don’t use WordPress” doesn’t get you out of it. Below is the full month, layer by layer, with every claim checked against the official CVE record.
We run managed hosting and watch these advisories across every stack we host. So this is the complete cross-stack picture of one month — built from NVD, the vendors’ own advisories and CISA’s exploited-vulnerabilities catalogue, not from headlines.
The month at a glance
| Layer | What had the hole | CVE | Severity | What it allows | Attacked? |
|---|---|---|---|---|---|
| CMS — Drupal | Core, on PostgreSQL | CVE-2026-9082 | 9.8 | Anonymous SQL injection into your database | Yes — real attacks |
| CMS — WordPress | Burst Statistics plugin (200,000+) | CVE-2026-8181 | 9.8 | Login check skipped → act as admin | not confirmed |
| CMS — Joomla | Core, the 2FA flow | CVE-2026-48896 | 7.5 | Two-factor login bypassed, no password | not confirmed |
| Framework — Next.js | Self-hosted server | CVE-2026-44578 | 8.6 | SSRF — your server fetches internal resources | not confirmed |
| Framework — Next.js | App Router middleware | CVE-2026-44575 | 7.5 | Protected pages reachable without the auth check | not confirmed |
| Language — PHP | SOAP extension | CVE-2026-6722 | 9.8 | Use-after-free → remote code execution | not confirmed |
| Store — PrestaShop | Back-office, via Contact form | CVE-2026-44212 | 9.3 | Unauthenticated stored XSS → back-office takeover | not confirmed |
| Store — Magento | Adobe Commerce (APSB26-49, 15 fixes) | CVE-2026-34686 | 8.7 | Stored XSS → code in admin; plus unauthenticated write | not confirmed |
| Web server — nginx | rewrite module | CVE-2026-42945 | 8.1 | Unauthenticated crash, possibly code execution | PoC public |
| Web server — Apache/nginx | HTTP/2 “Bomb” | CVE-2026-49975 | 7.5 | Memory-exhaustion denial of service | not confirmed |
| Control panel — cPanel | LiteSpeed cPanel plugin | CVE-2026-48172 | 9.8 | Privilege escalation — possibly to root | Yes — real attacks |
| Supply chain — npm | @tanstack/* packages | TanStack postmortem | — | 84 poisoned versions, credential theft | Yes — live attack |
| Supply chain — npm | 45 malicious packages | Microsoft Security | — | Developer / CI-secret reconnaissance | Yes — live attack |
Two quick translations. Severity is the standard 0–10 score (CVSS); 9.8 is about as bad as it gets short of 10. “No login” / unauthenticated means the attacker needs no account, no password, and no victim to click — they just send a request. Now, layer by layer.
The content systems: WordPress, Drupal, Joomla
Drupal was the one being used. On 20 May, Drupal core shipped a highly critical fix, CVE-2026-9082 (severity 9.8): an anonymous SQL injection on sites running PostgreSQL — feeding commands straight into your database through an ordinary request. The U.S. agency CISA added it to its Known Exploited Vulnerabilities catalogue two days later, meaning it was already being used in real attacks before most owners had read the advisory.
WordPress is its own weather system — hundreds of plugins, and in May the serious ones stacked up. Here are the month’s critical and high-severity plugin holes, every one exploitable with no login:
| Plugin (what it does) | Active sites | The hole | Severity |
|---|---|---|---|
| Burst Statistics — privacy analytics | 200,000+ | Authentication bypass → act as administrator (CVE-2026-8181) | 9.8 |
| Kirki — theme customizer framework | 500,000+ | Account takeover via a broken password reset (CVE-2026-8206) | 9.8 |
| WP Maps Pro — maps | commercial plugin | Creates a rogue administrator account → full takeover (CVE-2026-8732) | 9.8 |
| Avada Builder — theme builder | ~1,000,000 | SQL injection reads straight from your database (CVE-2026-4798) | 7.5 |
| Form Maker by 10Web — contact forms | widely used | SQL injection reads straight from your database (CVE-2026-3359) | 7.5 |
The irony pick is Burst Statistics — a privacy analytics plugin that let a stranger act as admin. (Kirki’s NVD record was enriched on 2 June, but the disclosure and patch were May.) It’s the same pattern as our WordPress-specific deep-dive: the famous core is solid; the danger is the dozen plugins bolted onto it. And these five are only the critical and high ones — Patchstack and Wordfence catalogue dozens more lower-severity WordPress advisories every single month.
Joomla released ten advisories on 26 May, all fixed in 5.4.6 / 6.1.1. The serious ones: a privilege escalation (an ordinary user gains admin rights) through the com_users batch task (CVE-2026-48898, the one High-severity item), two more privilege-escalation / access-control holes (CVE-2026-48904, CVE-2026-48899), and two separate two-factor-login bypasses (CVE-2026-48896, CVE-2026-48897) — the exact control you turned on to feel safe. The rest are lower-severity: two filter XSS bugs (cross-site scripting — a malicious script running in your visitor’s browser; CVE-2026-48905, CVE-2026-48903), a password-reset transport downgrade (CVE-2026-48902), a cache-key flaw (CVE-2026-48901) and a scheduler access-control issue (CVE-2026-48900).
The frameworks and the language: Next.js, React, PHP
The “modern” stack people choose to escape the plugin mess had a busier month than WordPress. On 7 May, Vercel shipped one Next.js security release covering 13 advisories (plus an upstream React fix), all resolved in 15.5.18 / 16.2.6. The high-severity ones for site owners: an SSRF (server-side request forgery — the server is tricked into making requests on the attacker’s behalf) that forces a self-hosted Next.js to fetch internal resources it shouldn’t be able to reach (CVE-2026-44578, 8.6); a middleware authorization bypass — crafted requests reach protected pages without your login check (CVE-2026-44575, 7.5); two further bypasses of the guard layer between request and app (CVE-2026-44574, CVE-2026-44573); and a connection-exhaustion denial of service. The rest of the thirteen are smaller, same family: cache poisoning (a visitor is served a tampered cached copy of a page, ×2), an image-handler denial of service and cross-site scripting (×2), plus a denial of service in React Server Components — React’s server side (CVE-2026-23870). Modern stack, same lesson: code is code, and it has holes.
And PHP — the language under your site — had the real surprise. Its 7 May release (8.2.31 / 8.3.31 / 8.4.21 / 8.5.6) fixed a 9.8 critical use-after-free in the SOAP extension, CVE-2026-6722: anyone who controls a SOAP request body can run code on a server that exposes a SOAP web service. The same release also patched a PHP-FPM status-page XSS (CVE-2026-6735, 6.1) and several lower-severity SOAP, DOM and HTML-parser fixes. Even the language under your site ships critical holes you have to install the fix for.
The online stores: PrestaShop, Magento
Stores are where the money is, so they’re where the attackers are. PrestaShop disclosed the nastier one on 14 May: CVE-2026-44212, rated 9.3. An unauthenticated attacker submits a malicious email through the public Contact us form; the script runs later, inside the privileged back-office, when your staff opens the message — a clean path to session hijack and full admin takeover. Patch: 8.2.6 / 9.1.1.
Magento / Adobe Commerce shipped bulletin APSB26-49 on 12 May — 15 fixes, up to 8.7. The worst is a stored XSS that can run code in the admin panel (CVE-2026-34686, 8.7, needs a low-privileged account). Two more are unauthenticated authorization bypasses that grant write access with no login at all (CVE-2026-34645, CVE-2026-34646, 7.5) — on a shop, “write access you shouldn’t have” is how card-skimmers and fake checkout pages get planted. A cluster of five (CVE-2026-34648 to -34652, 7.5) are denial-of-service through resource exhaustion; the remainder are file-write and security-bypass issues. Adobe reports no exploitation in the wild yet.
The web servers themselves: nginx, Apache
This is the layer most owners never think about, because it has nothing to do with their site — it’s the software serving every site on the box. On 13 May, nginx disclosed CVE-2026-42945 (8.1; 9.2 on the newer CVSS 4.0 scale): a heap buffer overflow (the program writes past the edge of its allotted memory) in the rewrite module that an unauthenticated attacker can trigger with crafted requests, crashing worker processes and — with the right conditions — potentially running code. A proof-of-concept was public within days.
And both nginx and Apache httpd are among the servers hit by the “HTTP/2 Bomb,” CVE-2026-49975 (7.5), disclosed at the very end of May: a single malicious request that exhausts server memory and knocks the server over. (NVD enriched it on 8 June; the coordinated disclosure was 27 May.)
The control panel: cPanel, all the way to root
The four layers above were in the website. This one is in the control panel — the admin dashboard bolted onto the server to make it easier to manage. The LiteSpeed cPanel plugin before 2.4.7 carried a 9.8 privilege-escalation flaw, and NVD’s record says it plainly: exploited in real attacks in May 2026, with escalation “possibly to root.” Root is total control of the whole server — every site, every database, every backup. Not one website; all of them. This is one reason our own stack doesn’t run cPanel: every admin panel you bolt on is more code, more logins, more attack surface, and when one breaks it takes down the box, not a page.
The supply chain: the packages your site is built from
Finally, the layer that isn’t a hole in your code at all — it’s poison in the code you install. May was a brutal month for it. On 11 May, attackers published 84 malicious versions across 42 @tanstack/* npm packages in a six-minute window, with code that harvested credentials (AWS, GCP, Kubernetes, Vault, GitHub, npm, SSH) and re-published itself through other maintainers’ packages — caught in about 20 minutes, per TanStack’s own postmortem. Late in the month (28–29 May), Microsoft flagged 45 malicious npm packages across three accounts, quietly fingerprinting developer machines for a follow-up. The PHP world wasn’t spared either: in late May, attackers rewrote the git tags of the laravel-lang Composer packages to steal CI secrets (reported by StepSecurity). If your site is built on Node or Laravel, a poisoned package is a hole that walks in through your own front door.
What actually got attacked
Three of the month’s holes were confirmed in real, active use, not theory:
- Drupal (CVE-2026-9082) — in CISA’s exploited catalogue two days after the patch.
- cPanel / LiteSpeed (CVE-2026-48172) — NVD states it was exploited in real attacks in May.
- The npm waves — live, in-the-wild campaigns aimed at credentials.
The nginx flaw had a public proof-of-concept within days, which is the step right before mass scanning. That’s the normal rhythm now: a fix ships, the public advisory tells attackers exactly where to look, and bots sweep the internet for whoever hasn’t updated. The danger lives in the gap between “fix released” and “fix installed on your site.”
The thread: it’s never the one layer you’d blame
Look back at the table. CMS, framework, language, store, web server, control panel, package registry — seven completely different layers, one month, and every one of them shipped something serious. The hole is never reliably in the famous core you’d worry about; it’s in the plugin, the self-hosted mode, the database driver, the 2FA flow, one authorization check, the rewrite module, the control panel, a package you didn’t write. And being “modern” is no exemption: even Astro, the static-first framework people pick for safety, had its own critical advisory earlier in 2026 (CVE-2026-33768, 9.1). There is no stack that takes you out of this. “We’re not on WordPress” buys nothing if no one is watching the other six layers.
What this means if you own the site, not the server
- There is no safe stack — only a watched one. Every layer above needs someone tracking its security feed. The question is never which technology; it’s whether anyone is paying attention to all of them at once.
- Fewer moving parts, fewer doors. Every plugin, package, add-on and control panel is more code that can ship a 9.8. The cPanel hole is the lesson: convenience layers are attack surface too.
- Update on the week, not the quarter. For a critical, no-login hole, “I’ll get to it” is losing a race to bots that move in days.
- Backups that actually restore — and off the server. When a hole does get used, the tested, off-site backup is the difference between a bad afternoon and a lost business.
Where we come in
This is exactly what managed hosting does in the background — and the reason it can’t be a WordPress-only job. We track the security feeds across every layer we run — CMS, framework, language, store, web server, packages — patch the critical ones inside the dangerous window, keep the moving parts lean, and run a server without cPanel and its bolted-on panels so there’s less to break. A 9.8 in the news becomes a five-minute update for our clients instead of a weekend of cleanup — wherever in the stack it lands.
To see, for free, which known holes affect your own site, start here: where to check which holes threaten your site. For the WordPress-specific wave, see four trusted plugins, four critical holes. And if your site was built and then handed off to nobody in particular — which is how these sit unpatched for months — start here: the developer disappeared, who’s watching the site now?
A note on scope
This is the notable picture of May 2026 — the critical and high-severity holes across each major web layer, plus what was confirmed under attack. It is not every CVE of the month: WordPress and its plugins alone generate dozens of lower-severity advisories that vendors like Patchstack and Wordfence catalogue in full, and we haven’t listed each one. We also left out items that don’t belong to May or to the web (for example, OpenCart’s template flaw [CVE-2026-3714] is from March and needs admin rights). Every figure above was checked against the official NVD record or the vendor’s own advisory before publishing.