Field brief
CVE‑2026‑78287: Staggs plugin RCE advisory released, no exploitation yet
A critical remote code execution vulnerability in the Staggs WordPress plugin has been officially advised, but no active exploitation has been observed.
A critical remote code execution (RCE) vulnerability, CVE‑2026‑78287, was officially announced for the Staggs WordPress plugin. The advisory, published on November 11 2026, identifies an improper code‑generation flaw that allows an unauthenticated attacker to inject and execute arbitrary code on any system running Staggs ≤ 3.3.0. The CVSS v3.1 base score is 10.0, and the GitHub Advisory GHSA‑frhh‑fmq4‑p6rw lists the fix as available. No exploitation has been reported in the two‑day window of November 12‑13, and the vulnerability is not yet in the CISA KEV catalog. WordPress site owners should upgrade to the latest Staggs release (3.3.1 or newer) and apply any vendor‑supplied patches immediately to mitigate the risk. Although no exploitation has been observed, the high severity and available proof‑of‑concept code mean that immediate action is recommended. For details, see the TheHackerWire advisory.
See what applies to your environment.
Use the Ncerio CVE feed to move from general intelligence to affected products.