PaperCut Under Fire: Another Emergency Patch Lands

Malicious actors are actively exploiting a freshly patched security flaw in PaperCut NG and MF to execute arbitrary code on vulnerable instances. The company rolled out a new emergency fix with extra hardening on [date].

This isn’t a drill. The vulnerability gives an unauthenticated attacker remote control over PaperCut’s trusted configuration, which could be used to execute arbitrary Java code inside the application’s context. In plain terms: no login required, full system compromise possible.

Security researchers have observed attackers chaining two distinct flaws to bypass authentication entirely. The first is an authentication bypass in the external user lookup feature. The second is a path traversal that allows file uploads to unintended locations. Together, they form a lethal combination.

How the Exploit Chain Works

The attack sequence is deceptively simple. First, the attacker exploits the authentication bypass to gain access to the PaperCut admin interface without credentials. Then, they leverage the path traversal to upload a malicious JSP file to the web root.

Once the file is in place, the attacker triggers it remotely, executing arbitrary Java code. The result? Complete takeover of the print server, including access to sensitive print jobs and network credentials.

Here’s a breakdown of the two flaws:

• Authentication bypass (CVE-2023-27350): This flaw allows unauthenticated attackers to bypass the login screen and access admin functions.
• Path traversal (CVE-2023-27351): This enables attackers to upload files to arbitrary directories, including the web root.

Who’s Affected and What to Do

PaperCut NG and MF versions before 20.1.7, 21.2.11, and 22.0.9 are vulnerable. If you’re running any of these, you need to act now.

The company has released patches for all affected versions. The emergency fix also includes additional hardening measures to prevent similar attacks in the future. But patching is only half the battle.

Admins should also review their PaperCut logs for any suspicious activity, particularly around external user lookups and file uploads. If you see anything unusual, assume compromise and conduct a thorough investigation.

Immediate Steps to Take

1. Apply the latest PaperCut patch immediately.
2. Check for unauthorized admin accounts.
3. Review server logs for unusual file uploads.
4. Reset all admin passwords and service account credentials.
5. Consider restricting network access to the PaperCut server.

Don’t wait for a scheduled maintenance window. This exploit is already in the wild, and the window for safe patching is closing fast.

Why This Matters for Your Organization

Print servers are often overlooked in security assessments. They sit quietly on the network, but they hold a treasure trove of data. Print jobs can contain confidential documents, and the server itself often has access to domain credentials.

This attack chain is particularly dangerous because it requires no authentication. That means any attacker who can reach the PaperCut web interface can compromise the server. It’s not a matter of if, but when.

If you’re using PaperCut, treat this as a critical incident. The fix is available, but the clock is ticking.

Broader Implications for Print Server Security

This isn’t the first time PaperCut has been in the spotlight. Earlier this year, a separate vulnerability was exploited by ransomware groups. The pattern is clear: print servers are a prime target.

Why? Because they’re often neglected. They run on outdated software, with default credentials, and no monitoring. Attackers know this, and they’re exploiting it.

The takeaway for IT teams: treat print infrastructure with the same rigor as your servers and endpoints. Patch promptly, monitor logs, and segment the network to limit blast radius.

For more on securing your infrastructure, check out our guide on print server security best practices. And if you’re dealing with a suspected breach, our incident response checklist can help.

Stay vigilant. The attackers aren’t slowing down, and neither should you.

WordPress Plugin Flaws: A Wake-Up Call for Site Owners

If you run a WordPress site, today’s news might make you want to pour a strong coffee. Security researchers at Wordfence and Patchstack have disclosed five critical vulnerabilities in popular plugins and themes. The flaws could let attackers bypass authentication, take over admin accounts, or even execute arbitrary code on your server.

That’s not hyperbole. The most severe issue carries a CVSS score of 9.8, which is about as bad as it gets. Here’s what you need to know, what’s affected, and how to protect yourself.

The Five Critical Flaws at a Glance

Let’s break down each vulnerability. Note that some are in plugins with hundreds of thousands of active installations, so the attack surface is significant.

1. WPMU DEV Dashboard – Authentication Bypass (CVE-2026-76581)

The headline grabber is CVE-2026-76581 in the WPMU DEV Dashboard plugin. With a CVSS score of 9.8, this authentication bypass flaw could allow any unauthenticated user to log in as an administrator. Yes, you read that right – no password needed. An attacker could essentially walk into your site’s back end and do whatever they want, from installing malicious plugins to wiping content.

Wordfence researchers found that the flaw exists in the plugin’s login mechanism. It fails to properly validate user identity under certain conditions. The plugin is widely used, so the potential impact is huge.

2. Avada Theme – Arbitrary File Upload

Next up is the Avada theme, one of the best-selling WordPress themes of all time. A critical flaw allows authenticated users with at least subscriber-level access to upload arbitrary files, including PHP shells. That means a low-privilege user could escalate to full remote code execution (RCE).

The issue lies in the theme’s demo import functionality, which fails to restrict file types properly. Given Avada’s massive user base, this is a serious concern for agencies and freelancers who manage multiple client sites.

3. TranslatePress – Stored XSS to Admin Takeover

TranslatePress, a popular multilingual plugin, has a stored cross-site scripting (XSS) vulnerability. While XSS often seems less severe, this one is nasty. An attacker can inject malicious scripts that execute when an admin visits the translation editor. That script can then create new admin users, effectively taking over the site.

What makes this worse is that the plugin is used on thousands of multilingual sites, and the vulnerability doesn’t require any special privileges to exploit – just the ability to submit a translation string.

4. Pods – SQL Injection

The Pods framework plugin, which lets users create custom content types, has a SQL injection flaw. This one allows an authenticated attacker with contributor-level access to read sensitive data from the database, including password hashes and user emails. In some configurations, it could even lead to full database takeover.

SQL injection is an old-school attack, but it remains effective when plugins fail to sanitize inputs. Pods is a developer favorite, so many custom-built sites could be at risk.

5. GiveWP – Privilege Escalation

Finally, GiveWP, a donation plugin for nonprofits, has a privilege escalation vulnerability. An authenticated user with minimal permissions can modify plugin settings and potentially execute arbitrary PHP code. For charities and NGOs, this could mean losing donor data or having their donation forms defaced.

The flaw was found in the plugin’s AJAX handler, which fails to check user capabilities before processing requests.

How to Protect Your WordPress Site

Here’s the thing: these vulnerabilities are not theoretical. Exploits are already being developed, and in some cases, attackers are actively scanning for vulnerable sites. The good news? You can protect yourself with a few simple steps.

• Update immediately: Check your WordPress admin dashboard for plugin and theme updates. The vendors have released patches, so update to the latest versions right now.
• Remove unused plugins: If you’re not using a plugin, delete it. Every plugin is a potential attack vector.
• Use a security plugin: Tools like Wordfence or Sucuri can block malicious traffic and alert you to suspicious activity.
• Enable two-factor authentication (2FA): This adds an extra layer of protection for admin accounts, even if an attacker tries to bypass authentication.
• Back up regularly: Keep offsite backups so you can restore your site quickly if something goes wrong.

What to Do If You’re Affected

If you’re using any of these plugins or themes, don’t panic. First, check your site for signs of compromise, such as unknown admin users, suspicious files, or unexpected changes. Then, apply the patches immediately. If you suspect an attack, change all passwords and consider a full malware scan from your hosting provider or a security expert.

Also, keep an eye on your server logs for unusual login attempts or file uploads. The sooner you catch an intrusion, the less damage it can do.

Staying Ahead of the Curve

WordPress powers over 40% of the web, which makes it a prime target. The WordPress security vulnerabilities landscape is constantly evolving, and staying informed is your best defense. Subscribe to security blogs, follow researchers on social media, and make updates a non-negotiable part of your routine.

Remember, these flaws were discovered by researchers who reported them responsibly. The patches are out, but it’s up to you to apply them. Don’t wait for a breach to take action.

In the meantime, if you’re managing multiple sites, consider using a management tool that automates updates. It’s a small investment that can save you from a major headache.

Stay safe out there.

Hasbro Data Breach: What We Know So Far

Toy and game giant Hasbro is notifying employees that their personal information may have been compromised in a data breach. The disclosure comes months after a cyberattack disrupted operations at the company earlier this year.

The notifications, filed with the Massachusetts Attorney General’s Office, contain limited details. But they confirm that exposed information—which varies by individual—may include names, email addresses, postal addresses, phone numbers, national ID numbers, and financial information.

It’s still unclear how many people are affected in total. The Massachusetts filing says 436 residents are impacted. Hasbro employs roughly 4,600 people worldwide, most of them in the United States, according to Revelio Labs data.

That suggests the total number could be in the hundreds or low thousands. No other state attorney general websites had published similar notifications at the time of writing.

The Link to the March Cyberattack

The timing raises an obvious question: is this connected to the cyberattack that hit Hasbro in late March? Back then, the company took some systems offline to respond, causing visible disruptions.

SecurityWeek asked Hasbro directly whether the new breach notification stems from that March incident. The company didn’t give a straight answer.

Instead, a spokesperson said Hasbro identified a security incident involving its network earlier this year and “took immediate action to address the incident.” That included launching an investigation with outside cybersecurity experts to determine what happened and what information may have been accessed.

The investigation concluded that some current and former employees’ personal information may have been accessed during the incident.

What Hasbro Is Doing Now

Hasbro says it is “not aware of any misuse of personal data” and has no indication the information will be misused. That’s the standard line in these situations, but it doesn’t mean affected employees should relax.

Out of an abundance of caution, the company is offering identity protection services through a third-party provider to those affected. If you’re a current or former Hasbro employee, that’s worth taking advantage of.

What Information Was Exposed?

According to the notification letters, the potentially exposed data includes:

• Names
• Email addresses
• Postal addresses
• Phone numbers
• National ID numbers
• Financial information

That’s a serious mix. Financial data and national ID numbers are exactly what identity thieves look for.

No Ransomware Group Has Claimed Credit

So far, no known cybercrime group has listed Hasbro on its leak website. That doesn’t rule out ransomware—many groups wait before publishing stolen data, or they negotiate quietly. But it’s a positive sign that the stolen information hasn’t been weaponized publicly.

The incident fits a broader pattern. Companies in every sector are facing similar attacks, and employee data is a prime target. If you’re tracking employee data exposure trends, this case is a textbook example of how a network intrusion can turn into a personal data nightmare.

What Employees Should Do

If you receive a notification letter from Hasbro, don’t ignore it. Here’s a practical checklist:

• Enroll in the offered identity protection services immediately
• Monitor bank accounts and credit reports for unusual activity
• Place a fraud alert on your credit file
• Change passwords on any accounts that might use the same credentials as your work accounts
• Be alert for phishing emails that reference Hasbro or the breach—scammers love to piggyback on news like this

For more on how to handle these situations, check out our guide on identity theft protection after a data breach.

The Bigger Picture

This isn’t an isolated event. Recent months have seen similar disclosures from other organizations. The ATF cyber incident after a ransomware group claimed an attack, and the Nutex Health data breach that exposed sensitive information, both show how widespread this problem has become.

Hasbro’s situation is a reminder that even household-name companies struggle with cybersecurity. The toy maker behind Monopoly, Nerf, and Dungeons & Dragons is now dealing with a very adult problem.

For affected employees, the next few months will be about vigilance. For the rest of us, it’s another data point in a troubling trend. Corporate networks are under constant attack, and when they fall, it’s often employees who pay the price.

We’ll update this story as more details emerge about the Hasbro data breach and its connection to the March cyberattack.