{"metadata": {"vulnerability": "cve-2026-8713", "count": 29, "kinds": {"milestone": 4, "sighting": 15, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-05-15T20:33:46.821Z", "date_only": false, "value": "2026-05-15T20:33:46.821Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "cve-2026-8713", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-05-15T20:49:10Z", "date_only": false, "value": "2026-05-15T20:49:10.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "cve-2026-8713", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-06-18T16:14:13Z", "date_only": false, "value": "2026-06-18T16:14:13.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "cve-2026-8713", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-06-19T04:31:34.491Z", "date_only": false, "value": "2026-06-19T04:31:34.491Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "cve-2026-8713", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-06-19T04:31:34.491Z", "date_only": false, "value": "2026-06-19T04:31:34.491Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "cve-2026-8713", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-19T06:17:10Z", "date_only": false, "value": "2026-06-19T06:17:10Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-47XM-33Q8-PW6W", "record": "GHSA-47XM-33Q8-PW6W", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-06-19T06:17:10.917Z", "date_only": false, "value": "2026-06-19T06:17:10.917", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-8713", "record": "FKIE_CVE-2026-8713", "field": "published"}, {"timestamp": "2026-06-19T06:31:56Z", "date_only": false, "value": "2026-06-19T06:31:56Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-47XM-33Q8-PW6W", "record": "GHSA-47XM-33Q8-PW6W", "field": "published"}, {"timestamp": "2026-06-19T06:31:56Z", "date_only": false, "value": "2026-06-19T06:31:56Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-47XM-33Q8-PW6W", "record": "GHSA-47XM-33Q8-PW6W", "field": "modified"}, {"timestamp": "2026-06-19T10:30:30.282Z", "date_only": false, "value": "2026-06-19T10:30:30.282516Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/116776306465494065", "record": "cve-2026-8713", "field": "creation_timestamp", "uuid": "457692e5-8aa9-4152-b292-445768073111", "content": "CVE-2026-8713: CRITICAL path traversal (CVSS 9.1) in Avada (Fusion) Builder \u22643.15.3. Unauthenticated file deletion possible; RCE risk if wp-config.php is removed. Restrict access, monitor usage, check vendor for fixes. https://radar.offseq.com/threat/cve-2026-8713-cwe-22-improper-limitation-of-a-path-82beab53eaced0fc #OffSeq #WordPress #Infosec", "url": "https://infosec.exchange/users/offseq/statuses/116776306465494065"}, {"timestamp": "2026-06-19T10:30:30.480Z", "date_only": false, "value": "2026-06-19T10:30:30.480265Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mon563pgxv2l", "record": "cve-2026-8713", "field": "creation_timestamp", "uuid": "62e32948-33ec-4cdf-ba26-bf0f2a432c06", "content": "CRITICAL path traversal in Avada (Fusion) Builder \u22643.15.3 lets unauthenticated attackers delete files \u2014 risking remote code execution. Restrict access, monitor activity, & check vendor advisories. https://radar.offseq.com/threat/cve-2026-8713-cwe-22-improper-limitation-of-a-path-82beab53eaced0fc ...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mon563pgxv2l"}, {"timestamp": "2026-06-19T13:19:15.836Z", "date_only": false, "value": "2026-06-19T13:19:15.836110Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/undercodenews.bsky.social/post/3mongltu7ft2a", "record": "CVE-2026-8713", "field": "creation_timestamp", "uuid": "278fb18d-f980-407e-8006-25455ccb219c", "content": "CVE-2026-8713: The Silent WordPress Plugin Flaw That Could Erase Your Entire Website in Seconds +\u00a0Video\n\nA Hidden Danger Inside One of WordPress\u2019 Most Popular Builders In the vast ecosystem of WordPress plugins, few tools are as widely used for page design and form building as the Avada Builder\u2026", "url": "https://bsky.app/profile/undercodenews.bsky.social/post/3mongltu7ft2a"}, {"timestamp": "2026-06-20T02:30:48.822Z", "date_only": false, "value": "2026-06-20T02:30:48.822569Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3moostal2o52d", "record": "CVE-2026-8713", "field": "creation_timestamp", "uuid": "1e0b5501-1d98-4b02-b76f-eb6e6d201c6d", "content": "Top 3 CVE for last 7 days:\nCVE-2026-50656: 26 interactions\nCVE-2026-54420: 26 interactions\nCVE-2026-20262: 20 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-20253: 6 interactions\nCVE-2026-47729: 5 interactions\nCVE-2026-8713: 4 interactions\n", "url": "https://bsky.app/profile/pmloik.bsky.social/post/3moostal2o52d"}, {"timestamp": "2026-06-21T12:11:05.519Z", "date_only": false, "value": "2026-06-21T12:11:05.519845Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mosdmdph4v2t", "record": "cve-2026-8713", "field": "creation_timestamp", "uuid": "c3ff26d1-324b-4d50-aaf7-0562d427ea02", "content": "\ud83d\udcf0 Peretas Eksploitasi Celah Keamanan Kebocoran Informasi pada Plugin WordPress Gravity SMTP\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/06/21/peretas-eksploitasi-celah-api-gravity-smtp-wordpress/\n\n#avadaBuilder #celahKeamanan #cve-2026-4020 #cve-2026-8713 #exploit #gravitySmtp ", "url": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mosdmdph4v2t"}, {"timestamp": "2026-06-22T00:31:43.229Z", "date_only": false, "value": "2026-06-22T00:31:43.229927Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3motn45ueih2b", "record": "CVE-2026-8713", "field": "creation_timestamp", "uuid": "a1ee76e6-66e8-4428-b695-d276979ff925", "content": "\ud83d\udea8  ALERT: CVE-2026-8713\n\nCVSS 9.1/10\n\n\ud83d\udccb WHAT IT IS:\nThe Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_files function in all versions up to, and including, 3.15.3. This makes it possible for unauthenti", "url": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3motn45ueih2b"}, {"timestamp": "2026-06-22T13:05:45.529Z", "date_only": false, "value": "2026-06-22T13:05:45.529105Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/mysites.guru/post/3mouxahndsg24", "record": "CVE-2026-8713", "field": "creation_timestamp", "uuid": "9830279c-f308-4578-b499-73bc7db6faad", "content": "Avada Builder 3.15.4 patches CVE-2026-8713: unauthenticated arbitrary file deletion (CVSS 9.1). Delete wp-config.php, WordPress drops to setup mode, an attacker's path to full RCE.\n\nFind affected sites:\nmysites.guru/blog/avada-b...", "url": "https://bsky.app/profile/mysites.guru/post/3mouxahndsg24"}, {"timestamp": "2026-06-22T14:56:49.907Z", "date_only": false, "value": "2026-06-22T14:56:49.907926Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-8713", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-06-22T14:56:49.907Z", "date_only": false, "value": "2026-06-22T14:56:49.907926Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-8713", "record": "FKIE_CVE-2026-8713", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-06-22T14:57:00.863Z", "date_only": false, "value": "2026-06-22T14:57:00.863Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "cve-2026-8713", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-06-22T14:57:00.863Z", "date_only": false, "value": "2026-06-22T14:57:00.863Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "cve-2026-8713", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-06-22T16:43:14.450Z", "date_only": false, "value": "2026-06-22T16:43:14.450", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-8713", "record": "FKIE_CVE-2026-8713", "field": "lastModified"}, {"timestamp": "2026-06-23T09:00:47.889Z", "date_only": false, "value": "2026-06-23T09:00:47.889374Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/mysites.guru/post/3mowzzenxmx2r", "record": "CVE-2026-8713", "field": "creation_timestamp", "uuid": "a0169fa0-9f4c-4537-b068-9ea1f93f3733", "content": "Avada Builder 3.15.4 patches CVE-2026-8713: unauthenticated arbitrary file deletion (CVSS 9.1). Delete wp-config.php, WordPress drops to setup mode, an attacker's path to full RCE.\n\nFind affected sites:\nmysites.guru/blog/avada-b...", "url": "https://bsky.app/profile/mysites.guru/post/3mowzzenxmx2r"}, {"timestamp": "2026-07-01T09:05:30.454Z", "date_only": false, "value": "2026-07-01T09:05:30.454160Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/donwebmedia.bsky.social/post/3mpl5z5jkqh2k", "record": "CVE-2026-8713", "field": "creation_timestamp", "uuid": "24dd6c77-5592-44d9-8fab-df0ad0a9dec3", "content": "Avada Builder CVE-2026-8713: 1M sitios en riesgo\n\nCVE-2026-8713 en Avada Builder permite borrar wp-config.php sin login y tomar control total del sitio. \u00bfTen\u00e9s versi\u00f3n 3.15.3 o anterior? Actualiz\u00e1 ya.\n\n#avadabuilder #cve20268713 #pathtraversal #borradodearchivos #wordpressplugin", "url": "https://bsky.app/profile/donwebmedia.bsky.social/post/3mpl5z5jkqh2k"}, {"timestamp": "2026-07-13T13:00:07.638Z", "date_only": false, "value": "2026-07-13T13:00:07.638415Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8334", "record": "CVE-2026-8713", "field": "creation_timestamp", "uuid": "c955f07d-aa31-4391-9a12-aa3c425f8d07", "content": "\u0417\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u0438\u0441\u0442\u0443\u043f\u0438\u043b\u0438 \u043a \u0437\u0430\u0434\u0435\u0439\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u043a\u043e\u043d\u0444\u0438\u0434\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e, \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 WordPress Gravity SMTP, \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u043d\u0430 100 000 \u0441\u0430\u0439\u0442\u0430\u0445.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-4020 \u0438 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0430 \u0441\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u043b\u0430\u0433\u0438\u043d\u0430, \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2.1.4 \u0438 \u0441\u0442\u0430\u0440\u0448\u0435, \u0438 \u0431\u044b\u043b\u0430 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 2.1.5, \u0432\u044b\u043f\u0443\u0449\u0435\u043d\u043d\u043e\u0439 17 \u043c\u0430\u0440\u0442\u0430.\n\nDefiant \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u0445\u0430\u043a\u0435\u0440\u044b \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c. \u041c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u044d\u043a\u0440\u0430\u043d Wordfence \u043e\u0442 Defiant \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043b \u0431\u043e\u043b\u0435\u0435 17 \u043c\u043b\u043d. \u043f\u043e\u043f\u044b\u0442\u043e\u043a \u0432\u0437\u043b\u043e\u043c\u0430 \u0441\u0430\u0439\u0442\u043e\u0432.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c REST API-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u043e\u043c \u0432 Gravity SMTP, \u0447\u0435\u0439 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 permission_callback \u0432\u0441\u0435\u0433\u0434\u0430 \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u0442 true, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u043c GET-\u0437\u0430\u043f\u0440\u043e\u0441\u0430\u043c \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u0438\u0441\u0447\u0435\u0440\u043f\u044b\u0432\u0430\u044e\u0449\u0438\u0439 JSON-\u043e\u0442\u0447\u0435\u0442 \u043e \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0441\u0433\u0435\u043d\u0435\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u043f\u043b\u0430\u0433\u0438\u043d\u043e\u043c.\n\n\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043e\u0442\u043a\u0440\u044b\u0442\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043c\u043e\u0436\u0435\u0442 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442\u044c:\n- \u043a\u043b\u044e\u0447\u0438 API, \u0441\u0435\u043a\u0440\u0435\u0442\u044b \u0438 \u0442\u043e\u043a\u0435\u043d\u044b OAuth \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0439 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0446\u0438\u0438 \u0441 \u044d\u043b\u0435\u043a\u0442\u0440\u043e\u043d\u043d\u043e\u0439 \u043f\u043e\u0447\u0442\u043e\u0439;\n- \u0443\u0447\u0435\u0442\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u0445 \u0441\u0435\u0440\u0432\u0438\u0441\u043e\u0432, \u0432\u043a\u043b\u044e\u0447\u0430\u044f Amazon SES, Google, Mailjet, Resend \u0438 Zoho;\n- \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 WordPress, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u043f\u043b\u0430\u0433\u0438\u043d\u044b, \u0442\u0435\u043c\u044b \u0438 \u0432\u0435\u0440\u0441\u0438\u0438 \u041f\u041e;\n- \u0434\u0430\u043d\u043d\u044b\u0435 \u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u0438 \u0441\u0440\u0435\u0434\u0435 PHP;\n- \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0432\u0435\u0440\u0441\u0438\u044e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0438 \u0438\u043c\u0435\u043d\u0430 \u0442\u0430\u0431\u043b\u0438\u0446.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0441\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, CVE-2026-4020 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0430 \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u043d\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043a\u0440\u0430\u0436\u0438 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u043e\u0447\u0442\u043e\u0432\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0438\u0441\u0430.\n\n\u042d\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u0434\u0430\u0432\u0430\u0442\u044c \u0441\u0435\u0431\u044f \u0437\u0430 \u0436\u0435\u0440\u0442\u0432\u0443 \u043f\u0435\u0440\u0435\u0434 \u0442\u0440\u0435\u0442\u044c\u0438\u043c\u0438 \u043b\u0438\u0446\u0430\u043c\u0438, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u043b\u0443\u0447\u0430\u0442\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u0443\u044e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u041f\u041e \u0441\u0430\u0439\u0442\u0430 \u0438 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445.\n\n\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 API \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u0440\u0435\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u0432\u0440\u0435\u043c\u0435\u043d\u0438 \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u0442\u044c \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u043c\u0438 \u043a \u0441\u0430\u0439\u0442\u0443 \u043f\u043e\u0447\u0442\u043e\u0432\u044b\u043c\u0438 \u0441\u0435\u0440\u0432\u0438\u0441\u0430\u043c\u0438, \u0430 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u043e\u0442\u0447\u0435\u0442 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u0443\u0441\u0438\u043b\u0438\u044f, \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u044b\u0435 \u0434\u043b\u044f \u043f\u043b\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0430\u0439\u0442.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Wordfence, \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u043e\u0432 \u0440\u0435\u0437\u043a\u043e \u0432\u043e\u0437\u0440\u043e\u0441\u043b\u0430 7 \u0438\u044e\u043d\u044f, \u0432 \u0442\u043e\u0442 \u0434\u0435\u043d\u044c \u0431\u044b\u043b\u043e \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043e 4 \u043c\u043b\u043d. \u0437\u0430\u043f\u0440\u043e\u0441\u043e\u0432. \u0410\u043d\u0430\u043b\u043e\u0433\u0438\u0447\u043d\u0430\u044f \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u043d\u0430\u0431\u043b\u044e\u0434\u0430\u043b\u0430\u0441\u044c \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043f\u043e\u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0438\u0445 \u0434\u043d\u0435\u0439.\n\nWordfence \u0441\u043e\u0441\u0442\u0430\u0432\u0438\u043b\u0430 \u0441\u043f\u0438\u0441\u043e\u043a \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u0440\u0430\u0441\u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u043d\u044b\u0445 IP-\u0430\u0434\u0440\u0435\u0441\u043e\u0432, \u0441 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043f\u043e\u0441\u0442\u0443\u043f\u0430\u044e\u0442 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043d\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430\u043c \u0432\u0435\u0431-\u0441\u0430\u0439\u0442\u043e\u0432 \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u0434\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u044d\u0442\u0438 \u0430\u0434\u0440\u0435\u0441\u0430 \u0432 \u0441\u0432\u043e\u0438 \u0441\u043f\u0438\u0441\u043a\u0438 \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0438.\n\n\u041a\u043b\u044e\u0447\u0435\u0432\u044b\u043c \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u043c \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043a /wp-json/gravitysmtp/v1/tests/mock-data, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0435 \u0432 \u0436\u0443\u0440\u043d\u0430\u043b\u0430\u0445 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0442\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u0442 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440 \u0437\u0430\u043f\u0440\u043e\u0441\u0430 ?page=gravitysmtp-settings.\n\n\u0412\u0447\u0435\u0440\u0430 Wordfence \u0442\u0430\u043a\u0436\u0435 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0435 \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0435 \u043e \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u043f\u0440\u0438\u0432\u043e\u0434\u044f\u0449\u0435\u0439 \u043a \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u0438\u044e \u0444\u0430\u0439\u043b\u043e\u0432 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u0432 \u043f\u043b\u0430\u0433\u0438\u043d\u0435 Avada Builder \u0434\u043b\u044f WordPress, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u043c\u043e\u043c \u043d\u0430 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0435 \u0441\u0430\u0439\u0442\u043e\u0432.\n\n\u0414\u0430\u043d\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u043a\u0430\u043a CVE-2026-8713 \u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0443\u0434\u0430\u043b\u044f\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435 \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c \u043e\u0431\u0445\u043e\u0434\u0430 \u043f\u0443\u0442\u0435\u0439, \u043f\u0440\u0438 \u0443\u0441\u043b\u043e\u0432\u0438\u0438, \u0447\u0442\u043e \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u043d\u0430\u044f \u0444\u043e\u0440\u043c\u0430 Avada \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d\u0430 \u043d\u0430 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445, \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0432 \u0431\u0430\u0437\u0443 \u0434\u0430\u043d\u043d\u044b\u0445.\n\n\u0423\u0434\u0430\u043b\u0435\u043d\u0438\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u044b\u0445 \u0444\u0430\u0439\u043b\u043e\u0432, \u0442\u0430\u043a\u0438\u0445 \u043a\u0430\u043a\u00a0wp-config.php, \u043c\u043e\u0436\u0435\u0442 \u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0441\u0430\u0439\u0442 \u0432 \u0438\u0441\u0445\u043e\u0434\u043d\u043e\u0435 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435, \u0447\u0442\u043e \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043f\u043e\u043b\u043d\u043e\u043c\u0443 \u0437\u0430\u0445\u0432\u0430\u0442\u0443 \u0441\u0430\u0439\u0442\u0430 \u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0431\u044b\u043b\u0430 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0430 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 3.15.4, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c\u043e\u0439 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0435\u0439 \u0434\u043b\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u043e\u0432 \u0441\u0430\u0439\u0442\u0430. \u0410\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2026-8713 \u043f\u043e\u043a\u0430 \u043d\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043e, \u043d\u043e \u044d\u0442\u043e \u043f\u043e\u043a\u0430, \u0442\u0430\u043a \u0447\u0442\u043e \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0440\u0438\u043d\u044f\u0442\u044c \u043e\u043f\u0435\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0435 \u043c\u0435\u0440\u044b.", "url": "https://t.me/true_secator/8334"}, {"timestamp": "2026-07-13T22:00:11.745Z", "date_only": false, "value": "2026-07-13T22:00:11.745800Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/92099", "record": "CVE-2026-8713", "field": "creation_timestamp", "uuid": "30d72efd-f7da-4a65-a307-ce2365cf612e", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-8713\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-05 22:32:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth path traversal to arbitrary file delete in Avada (Fusion) Builder <= 3.15.3 leading to RCE (CVSS 9.1)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/92099"}, {"timestamp": "2026-07-15T00:00:30.131Z", "date_only": false, "value": "2026-07-15T00:00:30.131709Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/92099", "record": "CVE-2026-8713", "field": "creation_timestamp", "uuid": "6a475619-e5f5-4318-929d-962e372162a2", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-8713\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a shinthink\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-05 22:32:32\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPre-auth path traversal to arbitrary file delete in Avada (Fusion) Builder <= 3.15.3 leading to RCE (CVSS 9.1)\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/92099"}, {"timestamp": "2026-07-16T19:00:21.062Z", "date_only": false, "value": "2026-07-16T19:00:21.062223Z", "kind": "sighting", "label": "Seen", "source": "Telegram/TkCLEUqHvSm7DM2Pr8tbMdhKn_vR4rxcfglQmpmq04jDkAI", "record": "CVE-2026-8713", "field": "creation_timestamp", "uuid": "94e51d9c-1ab0-4ff9-a69e-3277e43d8883"}, {"timestamp": "2026-07-18T01:00:09.666Z", "date_only": false, "value": "2026-07-18T01:00:09.666474Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/TkCLEUqHvSm7DM2Pr8tbMdhKn_vR4rxcfglQmpmq04jDkAI", "record": "CVE-2026-8713", "field": "creation_timestamp", "uuid": "a50d98f7-ffce-4019-9655-ed9df738e909"}, {"timestamp": "2026-07-27T15:00:03.778Z", "date_only": false, "value": "2026-07-27T15:00:03.778720Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-8713.yaml", "record": "CVE-2026-8713", "field": "creation_timestamp", "uuid": "06eed26b-9a33-4305-8096-4f497d116ef3", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-8713.yaml"}]}