Two 9.8s in WordPress plugins, a libaom encoder bug, and two dusty unquoted paths

Windows Firewall Control 4.8.6.0 has the same classic unquoted service path bug. The wfcs.exe service runs as LocalSystem, so a local attacker can plant a binary in the path and get SYSTEM-level code execution on reboot or service restart. Exploitation requires local access to a folder in the service's path.

Affected estate

Anyone running Windows Firewall Control 4.8.6.0 (by BiniSoft, now part of Malwarebytes)

How to check

Run: sc qc wfcs and check whether BINARY_PATH_NAME is unquoted and contains spaces.

Included because

local privilege escalation; requires existing access; niche product

Action

Upgrade to the latest release or manually quote the service path in the registry.

Urgency

Low. Local access required.

Why it matters

An attacker who already has local access can escalate to SYSTEM by abusing the unquoted path.

An attacker can hit a WooCommerce 7.1.0 endpoint and inject shell commands through the product-type parameter to write a malicious PHP file straight to the web root. That's unauthenticated remote code execution on your web server. No user interaction needed, and your entire WordPress/WooCommerce stack is at risk.

Affected estate

Anyone running WooCommerce 7.1.0 on WordPress, especially internet-facing stores

How to check

In wp-admin, go to Plugins and check the WooCommerce version. Or run: wp plugin list --field=name,version | grep woocommerce from the CLI.

Included because

unauthenticated; internet-facing; CVSS 9.8; common product; remote code execution

Action

Update WooCommerce to the latest version. Check your web root for any unexpected .php files that may have been planted.

Urgency

Critical. Unauthenticated RCE on internet-facing sites.

Why it matters

An attacker can fully compromise your web server and any data in the WordPress database, including customer payment and account info.

The Ultimate Addons for Beaver Builder plugin (version 1.2.4.1) lets an attacker bypass authentication entirely through the Google social login flow. By sending a crafted POST request with a valid admin email and nonce, the attacker gets session cookies and logs in as that admin. If your site exposes this plugin with social login enabled, anyone on the internet can take over an admin account.

Affected estate

WordPress site owners running Ultimate Addons for Beaver Builder 1.2.4.1 with social login enabled

How to check

In wp-admin, go to Plugins and check the UABB version. Confirm whether the social login module is active in the plugin settings.

Included because

unauthenticated; internet-facing; CVSS 9.8; authentication bypass to admin

Action

Update the plugin to the latest version. Review admin accounts and active sessions for signs of unauthorized access.

Urgency

Critical. Unauthenticated admin takeover on internet-facing sites.

Why it matters

An attacker can gain full WordPress admin access, which typically means they can install plugins, edit themes, and execute arbitrary code on the server.

A bounds validation bug in libaom's AV1 encoder lets an attacker feed crafted video frames that overwrite internal encoder structures. In services that fork to handle video encoding with SVC (Scalable Video Coding) enabled, an attacker can use crash behavior as an oracle to brute-force memory layout and eventually get arbitrary command execution. This needs a fairly specific setup: the target must accept attacker-supplied video, use libaom with SVC encoding, and run in a fork-based process model.

Affected estate

Teams running video processing or transcoding services that use libaom with SVC encoding enabled (media pipelines, streaming infrastructure, user-uploaded video processing)

How to check

Check your libaom version: dpkg -l libaom-dev or rpm -q libaom, or inspect the linked library version in your video pipeline binary. Confirm whether SVC encoding is enabled in your encoder configuration.

Included because

remote code execution; specific configuration required; common in media infrastructure; CVSS 7.1

Action

Update libaom to the patched version. If the update isn't available yet for your distro, consider disabling SVC encoding or restricting untrusted video input until you can patch.

Urgency

Moderate. Exploitable remotely but requires a specific configuration (SVC encoding plus attacker-supplied video).

Why it matters

An attacker who can submit video to your encoding pipeline could achieve remote code execution on the processing server.