Critical RCE + Public PoC Weekly: Sep 12–18, 2026

TL;DR

Three critical-severity remote code execution vulnerabilities with public proof-of-concept code crossed our emergent-threat monitors this week, and none of them are on CISA KEV yet. Two are unauthenticated WordPress plugin flaws — CVE-2026-87796 in Multi Uploader for Gravity Forms and CVE-2026-78006 in The Events Calendar — both reachable by anonymous visitors with no credentials and no user interaction. The third, CVE-2026-51990, is a network-reachable RCE in Sogou Input Method's biz_helper.exe component affecting any endpoint below 16.3.0.3498. All three carry CVSS 9.8, all three have public exploit code, and all three should be treated as actively exploitable this week.

Why this week matters

The KEV catalog is a lagging indicator. By the time a CVE lands there, exploitation is confirmed and the window for pre-emptive patching has usually closed. This week's set is a textbook example of the gap: three 9.8s with public PoCs, all internet-facing or network-reachable, none yet flagged by CISA. That gap is exactly where opportunistic scanning and mass exploitation happen.

Two of the three are WordPress plugin issues, which means the exposed population is enormous and the attack surface is trivially discoverable — attackers fingerprint plugins from the outside, and public PoC code removes any remaining barrier. The third is endpoint software that ships on Chinese-language workstation images, often by default, and frequently runs with user-level or elevated privileges. If you run any of these in production, the patch window is this week, not next.

CVE spotlight table

CVE	Published	One-line risk	Patch / mitigate action
CVE-2026-87796	Sep 17, 2026	Unauthenticated arbitrary file upload in Multi Uploader for Gravity Forms ≤ 1.1.9 via move_file; leads to RCE	Update plugin past 1.1.9 when vendor releases; until then disable the uploader or block chunked upload endpoints at the WAF
CVE-2026-51990	Sep 16, 2026	Network-reachable RCE in Sogou Input Method < 16.3.0.3498 via biz_helper.exe	Upgrade to 16.3.0.3498; inventory endpoints and isolate unpatched hosts
CVE-2026-78006	Sep 12, 2026	Unauthenticated RCE in The Events Calendar ≤ 6.17.4 via is_safe_widget_instance and PHP object injection	Patch past 6.17.4; if comments on events can't be disabled, take event pages offline until patched

Deep dives

CVE-2026-78006 — The Events Calendar unauthenticated RCE

This is the highest-priority item of the week. The Events Calendar is one of the most widely deployed WordPress plugins, and the exploit path is fully unauthenticated. The flaw lives in is_safe_widget_instance, which is supposed to validate serialized widget data before it reaches unserialize(). The validation can be bypassed because PHP fires magic methods during its pre-parse phase — before the plugin's checks run — and the enable_rendering_widget_copied() path can forge a valid wp_hash integrity attribute, so the payload looks trustworthy by the time deserialization happens. That gives an attacker a PHP object injection primitive they can steer toward a gadget chain and, ultimately, code execution as the web server user.

The delivery mechanism is what makes this so dangerous. The plugin's V2 single-event template runs do_blocks() over buffered comment HTML. WordPress returns a moderation-hash URL that lets an unauthenticated commenter immediately view their own pending comment — before moderation. So an attacker can post a comment containing injected block markup, view it via the moderation-hash URL, and have that markup rendered through the vulnerable code path with no credentials and no approval step. The only prerequisites are that comments are enabled and visible on event pages, which is the default on many sites.

Impact is total site compromise: wp-config.php credential theft, rogue admin accounts, persistent webshells, and lateral movement into shared hosting infrastructure. If you run The Events Calendar at or below 6.17.4 with comments enabled on events, treat this as an active incident until you've verified otherwise. Patch past 6.17.4 immediately; if you can't patch this week, disable comments on event pages or take event pages offline entirely.

CVE-2026-87796 — Multi Uploader for Gravity Forms arbitrary file upload

This one is an arbitrary file upload in the move_file function of Multi Uploader for Gravity Forms, affecting all versions through 1.1.9. The root cause is insufficient file type validation during chunked upload handling — the plugin reassembles chunks and moves the completed file into its final location without consistently enforcing extension, MIME type, or content signature checks across the chunked path. That's a classic CWE-434 unrestricted upload pattern, and in a typical WordPress deployment the file lands in a web-accessible directory, which is what turns a file-write bug into an RCE primitive.

The attack requires no credentials and no user interaction, and it's network-reachable with low complexity — hence the 9.8. An attacker who can write arbitrary files to a WordPress host can typically drop a PHP webshell or dropper into an uploads directory and invoke it over HTTP to run commands as the web server user. From there, the usual post-exploitation paths apply: read wp-config.php for database credentials and salts, pivot to the database, install persistent backdoors or rogue admin accounts, and use the host as a staging point for internal reconnaissance.

The source intelligence does not specify a patched version, so treat all versions through 1.1.9 as vulnerable until the vendor publishes a fix. In the meantime, disable the uploader feature if you can, and block chunked upload endpoints at the WAF. If you can't disable it, monitor uploads directories for unexpected PHP files and review web server logs for POST requests to the plugin's upload handler from unauthenticated sessions.

CVE-2026-51990 — Sogou Input Method RCE via biz_helper.exe

This is the endpoint-side item of the week, and it's the one most likely to be missed by teams that only monitor server infrastructure. CVE-2026-51990 is a remote code execution flaw in Sogou Input Method before 16.3.0.3498, reachable through the biz_helper.exe component. The vendor fixed it in 16.3.0.3498, and the CVE was published on September 16. The CVSS vector is 9.8 with network reachability, low complexity, no privileges, and no user interaction.

The exact weakness class isn't specified in the available intelligence, but the vector and the RCE outcome are consistent with a memory-safety or unsafe-deserialization flaw in a network-reachable helper process. Because biz_helper.exe is a helper binary, it may be launched by the main input method process or by other components, which can make the reachable attack surface broader than a single listening port. Defenders should assume any endpoint running an affected version is potentially exposed until the component is updated or isolated.

Successful exploitation means arbitrary code execution in the context of the helper process — command execution, additional tooling installation, and lateral movement using whatever privileges biz_helper.exe has. Input method software often runs with user-level or sometimes elevated privileges and is present on many workstations, so the business exposure is significant in environments with large Chinese-language user bases. Inventory endpoints running Sogou Input Method below 16.3.0.3498, prioritize systems where it's installed by default, and upgrade to 16.3.0.3498. If you can't patch immediately, isolate unpatched hosts from untrusted networks.

What is not on CISA KEV yet

All three CVEs in this week's roundup are marked as emergent threats and none are on CISA KEV as of the reporting window. That's the point of this roundup: these are the items that haven't yet been formally flagged but have public PoC code and confirmed RCE tagging from our emergent-threat monitoring. CVE-2026-78006 was published earliest (Sep 12) and has had the longest exposure window; CVE-2026-87796 and CVE-2026-51990 both published mid-week (Sep 16–17). The absence of a KEV listing should not be read as a signal that exploitation isn't happening — it means confirmation hasn't been published yet. Treat all three as actively exploitable and prioritize accordingly.

Defender checklist

1. Inventory exposure today. Query your asset management and vulnerability management platforms for The Events Calendar ≤ 6.17.4, Multi Uploader for Gravity Forms ≤ 1.1.9, and Sogou Input Method < 16.3.0.3498. Include WordPress multisite installs and any endpoint images that ship the input method by default.
2. Patch The Events Calendar first. It has the longest exposure window and the most permissive exploit path. If you can't patch past 6.17.4 this week, disable comments on event pages or take event pages offline.
3. Mitigate the Gravity Forms uploader. If no patched version is available, disable the Multi Uploader plugin or block its chunked upload endpoints at the WAF. Monitor uploads directories for unexpected PHP files.
4. Push Sogou Input Method 16.3.0.3498 to managed endpoints. Use your endpoint management tooling to force the upgrade. Isolate any host that can't be patched from untrusted networks.
5. Tune WAF and detection rules. Add signatures for chunked upload abuse against the Gravity Forms uploader, comment-based block injection against event pages, and anomalous biz_helper.exe network activity.
6. Run validation scans. After patching, re-scan to confirm the vulnerable versions are gone. Don't trust the patch job — verify it.
7. Hunt for post-exploitation indicators. Check for rogue admin accounts, unexpected PHP files in uploads directories, modified plugin files, and outbound connections from web servers or endpoints that shouldn't be making them.
8. Brief your SOC. Make sure on-call analysts know these three CVEs by number and know what the exploitation patterns look like in logs.

FAQ

Are these CVEs on CISA KEV? No. All three are marked as emergent threats and none are on the KEV catalog as of the reporting window. That doesn't mean they aren't being exploited — it means confirmation hasn't been published yet. Public PoC code exists for all three, which is the practical signal that matters.

Which one should I patch first? CVE-2026-78006 (The Events Calendar) has the longest exposure window and the most permissive exploit path — unauthenticated, no user interaction, comments enabled by default on many sites. Patch it first. CVE-2026-87796 and CVE-2026-51990 should follow immediately after.

What if I can't patch this week? For The Events Calendar, disable comments on event pages or take event pages offline. For Multi Uploader for Gravity Forms, disable the plugin or block its chunked upload endpoints at the WAF. For Sogou Input Method, isolate unpatched endpoints from untrusted networks. None of these are permanent fixes, but they reduce exposure while you schedule the patch.

How do I know if I've been exploited? Look for rogue administrator accounts, unexpected PHP files in uploads directories, modified plugin or theme files, and outbound connections from web servers or endpoints that shouldn't be making them. For the WordPress flaws, review web server logs for unauthenticated POST requests to the affected plugin endpoints and for comment submissions that triggered block rendering. For the input method flaw, check for anomalous biz_helper.exe network activity and unexpected child processes.