MSP Threat Radar Weekly Briefing — Week of 2026-07-20

This week’s briefing tracks 12 recent watch items across 6 vendors, with emphasis on active service incidents and high-priority operational issues.

Top items

WordPress Core SQL Injection Vulnerability

• Vendor: Wordpress
• Published: 2026-07-21
• Status: active
• Source: cisa-kev
• Official advisory: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due date: 2026-08-04.

WordPress Core Interpretation Conflict Vulnerability

• Vendor: Wordpress
• Published: 2026-07-21
• Status: active
• Source: cisa-kev
• Official advisory: https://wordpress.org/news/2026/07/wordpress-7-0-2-release/

WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due date: 2026-07-24.

DD-WRT Stack-Based Buffer Overflow Vulnerability

• Vendor: Dd Wrt
• Published: 2026-07-21
• Status: active
• Source: cisa-kev
• Official advisory: https://svn.dd-wrt.com/changeset/45724

DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due date: 2026-07-24.

Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

• Vendor: Langflow
• Published: 2026-07-21
• Status: active
• Source: cisa-kev
• Official advisory: https://github.com/langflow-ai/langflow/releases/tag/v1.9.0

Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. Due date: 2026-07-24.

Increase in errors from R2 in ENAM

• Vendor: Cloudflare
• Published: 2026-07-22
• Status: monitoring
• Source: cloudflare-status
• Official advisory: https://stspg.io/hmnc1v8pltzj

Cloudflare is aware of, and investigating an issue with an increased number of errors from R2 in Eastern North America. Further detail will be provided as more information becomes available.

Check cloudflare dependent workflows, notify affected clients if service disruption persists, and review workaround guidance from the official incident page.