CVE-2026-55964
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
Vulnerability in the WolfSSL library involves accepting intermediate certificates with CA:TRUE but without the keyCertSign key usage as signing CAs. Previously, temporary CAs added during certificate path building (WOLFSSL_TEMP_CA) were exempt from this check, allowing invalid certificates to be accepted. Now the check applies to temporary CAs as well, except for operator-loaded root certificates (WOLFSSL_USER_CA) and self-signed ones.
Risk Assessment
The risk is the potential use of an invalid intermediate certificate to sign other certificates, which could compromise trust in the certificate chain and enable man-in-the-middle attacks or impersonation of trusted entities.
Recommendation
It is recommended to update the WolfSSL library to a version where this check is fixed. If not possible, enable the ALLOW_INVALID_CERTSIGN option only in justified cases and after a thorough risk analysis.
Related vulnerabilities
- CVE-2026-87855Critical
The JTL-Connector plugin for WooCommerce up to version 2.4.3 is vulnerable to arbitrary file upload via the saveImage() function. This is due to accepting an empty jtlauth parameter as valid credentials and insufficient file type validation in handleImagePush(). This allows unauthenticated attackers to upload executable files, leading to remote code execution.
- CVE-2026-104800Critical
The AGE-GATE plugin for WordPress up to version 1.0 is vulnerable to remote code execution via the 'width' and 'height' parameters. This is due to missing authentication, capability checks, and nonce verification on the standalone admin.php endpoint, combined with unsanitized injection of POST parameters into generated PHP source. This allows unauthenticated attackers to execute code on the server.
- CVE-2026-97668Critical
The Abandoned Cart Pro plugin for WooCommerce up to version 10.8.0 is vulnerable to SQL injection via the guest cart persistent meta_value. This is due to insufficient escaping and lack of prepared statements in the update_guest_persistent_cart() function. The abandoned_cart_info value is concatenated directly into an UPDATE statement, allowing unauthenticated attackers to append additional SQL, potentially leading to data extraction and privilege escalation.
- CVE-2026-97657Critical
The Abandoned Cart Pro plugin for WooCommerce up to version 10.8.0 is vulnerable to authentication bypass via malleable encryption and bypassable HMAC. This is due to the use of MAC-free AES-CTR encryption for cart-recovery link tokens and a conditional HMAC check that can be bypassed by omitting the wcap_nonce parameter. This allows unauthenticated attackers with a single legitimate link to forge ciphertext and take over any user's account, including administrators.
- CVE-2026-110447Critical
Collabora Online Built-in CODE Server before version 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, exploited in the wild in September and October 2026. This is an OS command injection in proxy.php when the CODE server isn't running. The vulnerability is not present in standalone Collabora Online servers.
- CVE-2026-110002Critical
The Snazzy Social Media Feed plugin for WordPress up to version 2.5 is vulnerable to arbitrary file upload via the (file scope) function. This is due to missing WordPress bootstrap, authentication, capability, and nonce checks in the standalone save-to-cache.php script, combined with insufficient sanitization of the pluginURL parameter. This allows authenticated attackers with subscriber-level access and above to upload executable files, leading to remote code execution.
- CVE-2026-93388Critical
The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce up to version 2.9.1 is vulnerable to unauthenticated arbitrary file upload leading to remote code execution. The nbdesigner_copy_image_from_url AJAX action is registered for logged-out callers, and its Google Drive branch rebuilds the destination filename from the raw gapi[name] parameter, bypassing the allow-list, and writes the fetched bytes to a web-accessible directory. This allows unauthenticated attackers to write a .php file to an executable location and execute arbitrary code on the server.
- CVE-2026-92097Critical
The Click to Chat for WhatsApp plugin for WordPress up to version 4.44 is vulnerable to arbitrary shortcode execution. This is due to the greetings_dialog() function building the {url} placeholder from a filtered $_SERVER['REQUEST_URI'] on archive pages and then passing the substituted content to do_shortcode() without stripping shortcode delimiters. This allows unauthenticated attackers to execute arbitrary shortcodes registered by WordPress core, the active theme, or any other plugin.
- CVE-2026-110392Critical
Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Samsung Open Source QA-Board allows OS Command Injection.
- CVE-2026-97381Critical
Legacy Update is a tool for activating and installing updates on legacy Windows PCs. Legacy Update 1.12.0 through 1.13.1 contains an origin validation error in the IsPermitted method of its ActiveX control. After successfully reading the hosting document's hostname, a hostname that is not on the permitted list falls through without setting E_ACCESSDENIED, causing IsPermitted to return S_OK. An attacker who induces a user to visit a malicious webpage in Internet Explorer can invoke the control to enumerate update and system information, install updates without consent, display dialogs, or restart the computer when a reboot is pending. This issue was fixed in Legacy Update 1.13.2.
Original NVD description (English source)
Chain intermediate CA:TRUE without keyCertSign accepted as a signing CA. Intermediate CA certificates are required to have the keyCertSign key usage when a Key Usage extension is present, but chain-supplied temporary CAs (WOLFSSL_TEMP_CA) added while building a certificate path were previously exempted from this check, so an intermediate asserting CA:TRUE but lacking keyCertSign was accepted as a signing CA. The check now applies to chain-supplied temporary CAs as well; only operator-loaded root certificates (WOLFSSL_USER_CA) and self-signed roots remain exempt. Per RFC 5280 an absent Key Usage extension implies all usages, so the requirement is enforced only when the extension is actually present (extKeyUsageSet). Affects the OpenSSL-compatibility certificate-path-building path (X509_verify_cert / X509_STORE, OPENSSL_EXTRA/OPENSSL_ALL), where untrusted chain intermediates are added as temporary CAs; native (non-OpenSSL-compat) certificate verification does not create temporary CAs and is unaffected. Within those builds, the check applies unless ALLOW_INVALID_CERTSIGN is defined.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS