# IT Daily Roundup – September 19, 2026

> Sep 19, 2026 · #security #wordpress #cloud

WordPress patches critical Click2Shell flaw, actively exploited Acronis backup plugin vulnerability for cPanel, and thousands of sites still loading content from a re-registered CDN domain.

## 1. WordPress Patches Click2Shell – Clicking a Link Could Hand Attackers Full Server Control

WordPress 7.1.1 (released September 17) fixes a vulnerability dubbed Click2Shell, affecting WordPress 6.0 through 7.1.0. The flaw allows a specially crafted link to automatically install a theme from WordPress.org when opened by a logged-in administrator — no button click required. WordPress.org and the administrator's browser interpret the same URL differently, and attackers exploit this discrepancy to their advantage. The forced theme installation alone scores CVSS 7.1 (High), but researchers demonstrated that chained with a separate flaw in a specific theme, the attack reaches CVSS 9.6 (Critical) and allows arbitrary code execution directly on the server. No active exploitation in the wild has been confirmed yet, but a proof-of-concept has been published.

> **Why it matters:** WordPress powers the majority of small and mid-sized business websites. All it takes is a site administrator clicking a link — in a phishing email or a spoofed company chat message — for an attacker to gain full control of the web server. The fix is available free of charge as a standard WordPress 7.1.1 update; older supported branches have also been patched back to version 4.7. If your website is managed by an agency or external contractor, now is the time to verify the update has been applied.

## 2. Actively Exploited Acronis Backup Plugin Flaw for cPanel and Plesk – CISA Deadline Is Today

CISA has mandated that federal agencies patch CVE-2026-87886 (CVSS 7.8) by today (September 19) — a vulnerability in the Acronis Backup plugin for cPanel & WHM and the Acronis Backup extension for Plesk (both on Linux). The flaw stems from insecure file permissions: an attacker with low-privileged access to the server can escalate privileges and execute arbitrary code, gaining full control over the server — and potentially over all backups stored on it. The patch is available in Acronis Backup for cPanel version 1.9.3 HF3 and Acronis Backup for Plesk build 1.8.11.638 or later.

> **Why it matters:** cPanel and Plesk are the most widely used web hosting control panels — practically every SME running its own web server or shared hosting uses one of them. Acronis Backup is a popular backup solution in exactly this segment. Active exploitation in targeted attacks signals that attackers are actively scanning for and abusing this flaw. If your server (or your hosting provider's server) uses Acronis backup for cPanel or Plesk, contact your administrator and verify the patch has been applied — immediately.

## 3. Abandoned CDN Domain Re-Registered – Thousands of Sites Still Loading Content from an Unknown Owner

Security researchers have flagged a scenario strikingly similar to the polyfill.io incident of 2024: a CDN domain that thousands of websites, code repositories, and documentation pages had hard-coded references to expired and was re-registered by a new owner. That new owner now has full control over the domain including wildcard DNS — whatever they choose to serve there, visitors' browsers will load it as part of a trusted website. Currently the domain is showing an ad-heavy media downloader page, but the situation could change at any time: the same infrastructure could be used to distribute malware or harvest visitor credentials.

> **Why it matters:** Many SME websites were built years ago and have never been thoroughly audited — outdated CDN URLs in HTML templates or old plugins are commonplace. A single such URL means the security of your entire website depends on what a stranger who owns the domain decides to serve. The recommendation is concrete: (1) review all external scripts and stylesheets on your website (Chrome DevTools → Network or Sources tab) and (2) consider deploying a Content Security Policy (CSP) in report-only mode — a simple HTTP header parameter that surfaces unauthorized scripts without breaking anything on the site. This case is a good reminder why website security audits are worth doing at least once a year.

---

© 2026 ITself s.r.o. · Standard page: https://itself.sk/blog-en/2026-09-19-it-daily-roundup.html