Not on CISA's list of exploited flaws, and not in the news we track.
0.82%
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-126378. Nothing runs until you send it.
Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile() function that uses strpos() instead of strict path matching. Attackers with admin credentials can upload a ZIP containing a PHP file whose path includes /theme.php to achieve remote code execution on nginx deployments.