The Patch Gap: WooCommerce, Lateral Movement, and Email Gateway Exploits

The Daily CVE Update · Sep 16, 2026 · 14m

The Patch Gap: WooCommerce, Lateral Movement, and Email Gateway Exploits

Three active exploitation campaigns landed on 16 September 2026, and every single one targeted vulnerabilities with available patches. Corrine walks through the WooCommerce Wholesale Lead Capture plugin flaw (CVE-2026-27540) enabling unauthenticated file uploads, the eight-second lateral movement documented in a Marimo notebook exploit (CVE-2026-39987), and the SQL injection vulnerability in Cisco Secure Email Gateway (CVE-2026-76461) now confirmed under active attack. This episode focuses on the operational gap between…