Adobe Campaign, WordPress Login Bypass, and Gitea Code Injection

Adobe Campaign, WordPress Login Bypass, and Gitea Code Injection

•

Episode description

Adobe Campaign, WordPress Login Bypass, and Gitea Code Injection

Three CVSS 10.0 vulnerabilities landed in Adobe Campaign Classic within 24 hours, all enabling unauthenticated remote code execution. Attackers are actively exploiting an authentication bypass in the WordPress miniOrange SAML plugin that grants full administrator access without credentials. CISA has confirmed active exploitation of a Gitea code injection flaw that allows attackers with repository write access to execute arbitrary commands. This episode examines why these vulnerabilities matter to UK small businesses even when the affected software isn’t directly deployed in-house. Corrine explains how supply chain relationships with marketing agencies, MSPs, and web developers create exposure, outlines the GDPR accountability implications, and provides specific remediation steps including supplier verification questions, WordPress plugin audit procedures, and Gitea access controls.

Chapters

  • Introduction Three CVSS 10.0 scores in Adobe Campaign Classic, active exploitation of WordPress login bypass, and CISA-confirmed Gitea code injection all emerged within 24 hours.
  • Adobe Campaign Classic: Three CVSS 10.0 Scores in 24 Hours CVE-2026-76193, CVE-2026-76195, and CVE-2026-76197 enable unauthenticated remote code execution. Supply chain exposure through marketing agencies and email service providers creates risk for small businesses even without direct deployment.
  • Call to Action Listener engagement request for ratings, reviews, and sharing.
  • WordPress Admin Bypass: No Password Required Active exploitation of CVE-2026-15981 in miniOrange SAML 2.0 plugin allows unauthenticated attackers to gain full administrator access. Plugin audit and update procedures outlined.
  • Gitea Code Injection: Confirmed Exploited CVE-2026-60004 added to CISA Known Exploited Vulnerabilities catalogue. Attackers with repository write access can execute arbitrary commands. Access control audit required.
  • Why This Week’s Stories Are a Supply Chain Problem Small businesses face exposure through third-party service providers. GDPR accountability extends to data processors and sub-processors regardless of direct deployment.
  • What to Do Before Friday Five-point action list: verify Adobe Campaign Classic patch status with suppliers, audit WordPress plugins, patch Gitea instances, contact service providers with specific questions, subscribe to NCSC alerts.
  • Closing Recap of the three vulnerability families and emphasis on supplier verification as the most critical immediate action.

Links