actively-exploited-vulnerabilitywidely-deployed-product-advisoryproof-of-concept-releaseinternet-facing-service-vulnerability

Multiple Critical Vulnerabilities Disclosed Across Popular Software Platforms

Active Exploitation · 14 sources · Updated 4mo ago · First seen Dec 4, 2025

A series of critical vulnerabilities have been disclosed affecting a wide range of popular software platforms, including WordPress plugins, web frameworks, developer tools, and enterprise applications. Notable issues include unauthenticated remote code execution (RCE) flaws in Next.js (CVE-2025-66478), WordPress core (CVE-2025-6389), and the ACF Extended plugin (CVE-2025-13486), as well as privilege escalation and authentication bypass vulnerabilities in the WP Directory Kit plugin (CVE-2025-13390) and cPanel. Several of these vulnerabilities are reported to be under active exploitation, with proof-of-concept code available for some, increasing the urgency for immediate patching and mitigation.

Other significant disclosures include a high-severity flaw in Vim for Windows (CVE-2025-66476) allowing arbitrary code execution, a critical SQL injection chain in Synology BeeStation, and a directory traversal vulnerability in cPanel that could lead to full server takeover. Additional advisories cover issues in lz4-java, Longwatch OT surveillance, Django, Elementor, Apache Struts, nopCommerce, and OpenVPN, with many rated as critical or high severity by CVSS. Organizations are strongly advised to review affected products and apply security updates promptly to mitigate the risk of exploitation.

This is being exploited nowSee which actors are running it and whether you're in range.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

14 events · Dec 2, 2025 – Dec 4, 2025

Dec 4, 202511mo ago
WordPress CVE-2025-6389 reported under active exploitation
A critical WordPress vulnerability, CVE-2025-6389, was disclosed as allowing unauthenticated remote code execution, with reports that attackers were already actively exploiting the flaw.
Dec 4, 202511mo ago
Next.js maximum-severity RCE CVE-2025-66478 disclosed
A critical remote code execution flaw in Next.js, CVE-2025-66478, was disclosed with a CVSS score of 10.0, indicating maximum severity and significant risk to affected deployments.
Dec 4, 202511mo ago
Vim for Windows CVE-2025-66476 disclosed
A high-severity Vim for Windows vulnerability, CVE-2025-66476, was reported as risking arbitrary code execution when users interact with compromised folders.
Dec 4, 202511mo ago
Synology BeeStation flaw chain with root RCE and PoC revealed
A Synology BeeStation exploit chain combining SQL injection with a novel dirty file write technique was disclosed as leading to root remote code execution, and a proof-of-concept was made available.
Dec 3, 202511mo ago
WP Directory Kit CVE-2025-13390 disclosed as auth bypass to admin takeover
CVE-2025-13390 was published for WP Directory Kit versions through 1.4.4, describing a predictable auto-login token weakness that allows unauthenticated attackers to bypass authentication and gain administrative access.
Dec 3, 202511mo ago
ACF Extended CVE-2025-13486 exposes 100,000 WordPress sites to RCE
A critical flaw in the ACF Extended WordPress plugin, CVE-2025-13486, was disclosed as allowing unauthenticated remote code execution and affecting roughly 100,000 sites.
Dec 3, 202511mo ago
Critical cPanel traversal and LPE flaw disclosed
A critical cPanel vulnerability with CVSS 9.3 was reported as enabling directory traversal and local privilege escalation, potentially leading to full server takeover in shared hosting environments.
Dec 3, 202511mo ago
Elementor plugin flaw CVE-2025-8489 reported under active exploitation
A critical Elementor plugin vulnerability, CVE-2025-8489, was disclosed with a CVSS score of 9.8 and reports of active exploitation enabling unauthenticated administrator takeover.
Dec 3, 202511mo ago
Django SQL injection flaw CVE-2025-13372 disclosed
A vulnerability in Django, tracked as CVE-2025-13372, was reported as allowing SQL injection through PostgreSQL FilteredRelation handling.
Dec 3, 202511mo ago
CISA warns of critical Longwatch OT surveillance RCE
CISA issued a warning for CVE-2025-13658, a critical Longwatch vulnerability rated CVSS 9.8 that could allow unauthenticated attackers to gain SYSTEM-level control of OT surveillance deployments.
Dec 3, 202511mo ago
lz4-java CVE-2025-12183 prompts migration to community fork
A high-severity vulnerability, CVE-2025-12183, was reported in the discontinued lz4-java library, with users urged to migrate to a community-maintained fork because the original project is no longer maintained.
Dec 2, 202511mo ago
nopCommerce session flaw CVE-2025-11699 reported
CVE-2025-11699 in nopCommerce was disclosed as a session management flaw that could allow attackers to reuse admin session cookies after logout and take over administrator accounts.
Dec 2, 202511mo ago
OpenVPN fixes critical heap over-read and HMAC bypass flaws
A report disclosed critical OpenVPN vulnerabilities including a heap over-read rated CVSS 9.1 and an HMAC bypass issue that could enable denial-of-service attacks, indicating fixes were made available.
Dec 2, 202511mo ago
Apache Struts file leak vulnerability CVE-2025-64775 disclosed
A new Apache Struts vulnerability, CVE-2025-64775, was identified and reported as a file leak issue that could let attackers exhaust disk space on affected systems.

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

11 linked

Unauthenticated Remote Code Execution in Sneeit Framework for WordPress (CVE-2025-6389)Unauthenticated Administrator Account Creation in King Addons for Elementor (CVE-2025-8489)Out-of-bounds Memory Access in lz4-java (CVE-2025-12183)Session cookie invalidation flaw in nopCommerce (CVE-2025-11699)Apache Struts multipart request processing file leak DoS (CVE-2025-64775)SQL Injection in Django FilteredRelation Column Aliases (CVE-2025-13372)Unauthenticated RCE in Longwatch devices via exposed HTTP endpoint (CVE-2025-13658)Uncontrolled Search Path Arbitrary Code Execution in Vim for Windows (CVE-2025-66476)Unauthenticated RCE in Advanced Custom Fields: Extended for WordPress (CVE-2025-13486)Authentication Bypass in WP Directory Kit auto-login endpoint (CVE-2025-13390)+1 more

Affected products

2 linked

StrutsCpanel

Organizations

8 linked

ACF ExtendedElementorWordpressVimSynologyCpanelVercelNopcommerce

Do you run this?Correlate live exploitation activity against the software you actually run, and see where you're exposed.

See Who's Exploiting This

Source coverage

Sources

14 references tracked. Mallory keeps watching after this page renders.

Security Online InfoNews · Dec 4, 2025

Maximum Severity Alert: Critical RCE Flaw Hits Next.js (CVE-2025-66478, CVSS 10.0)Open source ↗

Security Online InfoNews · Dec 4, 2025

High-Severity Vim for Windows Flaw (CVE-2025-66476) Risks Arbitrary Code Execution from Compromised FoldersOpen source ↗

Security Online InfoNews · Dec 4, 2025

Critical WordPress Flaw (CVE-2025-6389) Under Active Exploitation Allows Unauthenticated RCEOpen source ↗

Security Online InfoNews · Dec 4, 2025

Synology BeeStation Flaw Chain Leads to Root RCE Via Novel “Dirty File Write” SQL Injection, PoC AvailableOpen source ↗

6 additional sources from 03-12-2025 to 03-12-2025

Security Online InfoNews · Dec 3, 2025

Critical Elementor Plugin Flaw (CVE-2025-8489, CVSS 9.8) Under Active Exploitation Allows Unauthenticated Admin TakeoverOpen source ↗

Security Online InfoNews · Dec 2, 2025

CVE-2025-64775: Apache Struts “File Leak” Vulnerability Threatens Disk ExhaustionOpen source ↗

Security Online InfoNews · Dec 2, 2025

nopCommerce Flaw (CVE-2025-11699) Allows Admin Takeover by Reusing Session Cookies After LogoutOpen source ↗

Security Online InfoNews · Dec 2, 2025

Critical OpenVPN Flaws Fix: Heap Over-Read (CVSS 9.1) and HMAC Bypass Allow DoS AttacksOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Multiple Critical Vulnerabilities Disclosed Across Popular Software Platforms

How this story unfolded

WordPress CVE-2025-6389 reported under active exploitation

Next.js maximum-severity RCE CVE-2025-66478 disclosed

Vim for Windows CVE-2025-66476 disclosed

Synology BeeStation flaw chain with root RCE and PoC revealed

WP Directory Kit CVE-2025-13390 disclosed as auth bypass to admin takeover

ACF Extended CVE-2025-13486 exposes 100,000 WordPress sites to RCE

Critical cPanel traversal and LPE flaw disclosed

Elementor plugin flaw CVE-2025-8489 reported under active exploitation

Django SQL injection flaw CVE-2025-13372 disclosed

CISA warns of critical Longwatch OT surveillance RCE

lz4-java CVE-2025-12183 prompts migration to community fork

nopCommerce session flaw CVE-2025-11699 reported

OpenVPN fixes critical heap over-read and HMAC bypass flaws

Apache Struts file leak vulnerability CVE-2025-64775 disclosed

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Multiple Unrelated Critical Vulnerabilities Disclosed in October 2025

Multiple High-Impact Vulnerabilities Disclosed Across Diverse Software Platforms