{"metadata": {"vulnerability": "CVE-2026-6261", "count": 19, "kinds": {"milestone": 4, "sighting": 5, "kev": 0, "other": 10}}, "data": [{"timestamp": "2026-04-13T23:57:52.714Z", "date_only": false, "value": "2026-04-13T23:57:52.714Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-6261", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-04-14T00:13:32Z", "date_only": false, "value": "2026-04-14T00:13:32.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-6261", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-05-04T22:35:37Z", "date_only": false, "value": "2026-05-04T22:35:37.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-6261", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-05-05T11:25:00.302Z", "date_only": false, "value": "2026-05-05T11:25:00.302Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-6261", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-05T11:25:00.302Z", "date_only": false, "value": "2026-05-05T11:25:00.302Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Wordfence", "record": "CVE-2026-6261", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-05-05T12:16:21Z", "date_only": false, "value": "2026-05-05T12:16:21Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-XJRR-VQ8H-V4XH", "record": "GHSA-XJRR-VQ8H-V4XH", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-05-05T12:16:21.453Z", "date_only": false, "value": "2026-05-05T12:16:21.453", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-6261", "record": "FKIE_CVE-2026-6261", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-05T12:31:39Z", "date_only": false, "value": "2026-05-05T12:31:39Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-XJRR-VQ8H-V4XH", "record": "GHSA-XJRR-VQ8H-V4XH", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-05-05T12:31:39Z", "date_only": false, "value": "2026-05-05T12:31:39Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-XJRR-VQ8H-V4XH", "record": "GHSA-XJRR-VQ8H-V4XH", "field": "modified"}, {"timestamp": "2026-05-05T12:45:52.621Z", "date_only": false, "value": "2026-05-05T12:45:52.621571Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ml47qqdazm2k", "record": "CVE-2026-6261", "field": "creation_timestamp", "uuid": "180b084d-d861-49d1-af7a-c707f50547ba", "content": "CVE-2026-6261 - Betheme\nCVE ID : CVE-2026-6261\n \n Published : 5. Mai 2026 11:25 | 56\u00a0Minuten ago\n \n Description : The Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 28.4. This is due to the upload_icons() function workflow ...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3ml47qqdazm2k"}, {"timestamp": "2026-05-05T15:00:03.994Z", "date_only": false, "value": "2026-05-05T15:00:03.994122Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-6261", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-05-05T15:00:03.994Z", "date_only": false, "value": "2026-05-05T15:00:03.994122Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-6261", "record": "FKIE_CVE-2026-6261", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-05-05T15:01:12.799Z", "date_only": false, "value": "2026-05-05T15:01:12.799Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-6261", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-05-05T15:01:12.799Z", "date_only": false, "value": "2026-05-05T15:01:12.799Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-6261", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-05-05T16:35:52.458Z", "date_only": false, "value": "2026-05-05T16:35:52.458004Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml4mlxvrp72r", "record": "CVE-2026-6261", "field": "creation_timestamp", "uuid": "dd84a52b-2d17-4a21-a37e-64e0792f649f", "content": "\ud83d\udfe0 CVE-2026-6261 - High (8.8)\n\nThe Betheme theme for WordPress is vulnerable to Arbitrary File Upload in versions up to, and inc...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-6261/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml4mlxvrp72r"}, {"timestamp": "2026-05-06T22:39:09.745Z", "date_only": false, "value": "2026-05-06T22:39:09.745772Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/donwebmedia.bsky.social/post/3ml7rejkand2c", "record": "CVE-2026-6261", "field": "creation_timestamp", "uuid": "5b20b049-9d18-48a6-81b7-bd1099a6041d", "content": "Betheme RCE 2026: actualiz\u00e1 ya a 28.4.1.1\n\n\u00bfUs\u00e1s Betheme 28.4? CVE-2026-6261 permite RCE a cualquier autor de tu sitio. Actualiz\u00e1 a 28.4.1.1 ya y audit\u00e1 uploads antes de que sea tarde.\n\n#betheme #cve20266261 #rcewordpress #cargaarchivosarbitrarios #seguridadtemaswordpress", "url": "https://bsky.app/profile/donwebmedia.bsky.social/post/3ml7rejkand2c"}, {"timestamp": "2026-05-20T05:46:11.758Z", "date_only": false, "value": "2026-05-20T05:46:11.758378Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/vuldb/statuses/116605319339057363", "record": "CVE-2026-6261", "field": "creation_timestamp", "uuid": "07b9bd58-61cc-47df-9830-89ff9f9d1be8", "content": "A lot of offensive activities were identified targeting MuffinGroup Betheme Plugin (CVE-2026-6261) https://vuldb.com/vuln/361146/cti", "url": "https://infosec.exchange/users/vuldb/statuses/116605319339057363"}, {"timestamp": "2026-09-12T10:00:16.334Z", "date_only": false, "value": "2026-09-12T10:00:16.334711Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/shimiscyberworld/1233", "record": "CVE-2026-6261", "field": "creation_timestamp", "uuid": "d8c059d1-5407-483e-96b3-d5cfa116c170", "content": "\ud83d\udee1\ufe0f SCW \u2502 Daily Vulnerability Digest\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83d\udcc5 2026-05-05\n\n\ud83d\udcca 52 vulnerabilities detected today \u2014 14 \ud83d\udd34 Critical, 38 \ud83d\udd34 High\n\n\ud83d\udd34 CRITICAL\n  \u2022 CVE-2026-7411 (10) \u2014 Eclipse BaSyx RCE: Critical Path Traversal in Server SDK\n  \u2022 CVE-2026-5722 (9.8) \u2014 MoreConvert Pro WordPress Plugin Critical Authentication\u2026\n  \u2022 CVE-2025-13618 (9.8) \u2014 CVE-2025-13618: WordPress Mentoring Plugin Allows Admin\u2026\n  \u2022 CVE-2026-5294 (9.8) \u2014 CVE-2026-5294: Critical RCE in Geeky Bot WordPress Plugin\n  \u2022 CVE-2026-7823 (9.8) \u2014 CVE-2026-7823: Critical Command Injection in Totolink\u2026\n  \u2022 CVE-2023-54342 (9.8) \u2014 Eclipse Equinox OSGi RCE: Critical Vulnerability Allows\u2026\n  \u2022 CVE-2023-54344 (9.8) \u2014 Eclipse Equinox OSGi RCE: Critical Vulnerability Exposes\u2026\n  \u2022 CVE-2026-7834 (9.8) \u2014 CVE-2026-7834: Critical Stack-Based Buffer Overflow in EFM\u2026\n  \u2026 and 6 more\n\n\ud83d\udd34 HIGH\n  \u2022 CVE-2023-54345 (8.8) \u2014 Frappe Framework ERPNext Sandbox Escape Allows RCE via\u2026\n  \u2022 CVE-2023-54348 (8.8) \u2014 ERPGo SaaS 3.9 CSV Injection Allows RCE via Vendor Fields\n  \u2022 CVE-2026-42434 (8.8) \u2014 OpenClaw Sandbox Escape (CVE-2026-42434) Allows Remote\u2026\n  \u2022 CVE-2026-42435 (8.8) \u2014 OpenClaw CVE-2026-42435: Shell Wrapper Vulnerability Allows\u2026\n  \u2022 CVE-2026-43530 (8.8) \u2014 OpenClaw Vulnerability CVE-2026-43530 Undermines Exec\u2026\n  \u2022 CVE-2026-43569 (8.8) \u2014 OpenClaw Authentication Bypass (CVE-2026-43569) Poses High\u2026\n  \u2022 CVE-2026-43571 (8.8) \u2014 CVE-2026-43571: OpenClaw Plugin Trust Bypass Opens Attack\u2026\n  \u2022 CVE-2026-6261 (8.8) \u2014 Betheme WordPress Arbitrary File Upload RCE (CVE-2026-6261)\n  \u2022 CVE-2026-7855 (8.8) \u2014 D-Link DI-8100 Buffer Overflow - CVE-2026-7855 Public\u2026\n  \u2022 CVE-2026-35228 (8.7) \u2014 Oracle MCP Server Helper Tool Vulnerability Allows\u2026\n  \u2026 and 28 more\n\n\ud83d\udcd6 View all vulnerabilities \u2192\n\n\ud83c\udfaf Need SIEM rules for these threats?\nGenerate detection rules for Splunk, Sentinel, QRadar & more \u2014 tailored per breach\nOpen /detect in Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "url": "https://t.me/shimiscyberworld/1233"}, {"timestamp": "2026-10-26T19:10:00.163Z", "date_only": false, "value": "2026-10-26T19:10:00.163", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-6261", "record": "FKIE_CVE-2026-6261", "field": "lastModified"}], "metrics": {"as_of": "2026-10-29T03:46:08.082Z", "anchors": {"origin": {"timestamp": "2026-05-05T11:25:00.302Z", "date_only": false, "value": "2026-05-05T11:25:00.302Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-6261", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-05-05T11:25:00.302Z", "date_only": false, "value": "2026-05-05T11:25:00.302Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-6261", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 15265267.780988, "hours": 4240.3521613855555, "days": 176.6813400577315, "min_seconds": 15265267.780988, "max_seconds": 15265267.780988, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-05-05T11:25:00.302Z", "date_only": false, "value": "2026-05-05T11:25:00.302Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-6261", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-29T03:46:08.082Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}