Open-source business platforms, week 43 of 2026: Frappe blind SQL injection leads four vulnerabilities

The release at a glance

This release covers four vulnerabilities published between 19 and 25 October 2026 by the maintainers of Frappe Framework, Dolibarr and WordPress. Three of the four have a CVE id; the fourth is security advisory GHSA-7cxg-q8x5-rpjh for Frappe Framework. Severity breaks down as one high and three medium. Frappe / ERPNext accounts for two entries, Dolibarr for one and WordPress for one. None of the four is listed in CISA's Known Exploited Vulnerabilities catalogue, and the CVE records do not report exploitation in the wild.

What matters most

Frappe / ERPNext

CVE-2026-114664 is a blind SQL injection in frappe.desk.doctype.event.event.get_events before Frappe Framework 16.33.0. An authenticated attacker can supply crafted input to get_events and infer database contents from the application's responses. CVSS 4.0 score is 7.1, high; the vector shows network reachability with low privileges. Fixed in Frappe 16.33.0.

Security advisory GHSA-7cxg-q8x5-rpjh is broken access control in File list/report queries. It can disclose private-file metadata. Fixed versions are Frappe Framework 16.35.0 and 15.121.1; the advisory states there are no workarounds.

Dolibarr

CVE-2026-112361 is a protection mechanism failure in htdocs/document.php, part of Dolibarr's CSP component, affecting versions 23.0.0 through 23.0.2. It can be executed remotely and carries CVSS 4.0 score 5.3, medium. Upgrading to Dolibarr 24.0.0 is sufficient to resolve it.

WordPress

CVE-2026-114570 is stored cross-site scripting via Quick Edit in WordPress Core, described in the advisory title as affecting versions up to and including 7.0.2. Authenticated users with Contributor-level access or above can inject scripts that execute when a higher-privileged user opens the affected administrative screens. The description notes the issue only affects sites with a large number of users. The CVE record does not list a fixed version.

Patch in this order

1. Frappe / ERPNext first. The blind SQL injection is the highest-rated issue. Update to Frappe Framework 16.35.0 or 15.121.1 to resolve both Frappe issues in this release; 16.33.0 is the minimum for CVE-2026-114664.
2. Dolibarr next. Move installations on 23.0.0 through 23.0.2 to Dolibarr 24.0.0.
3. WordPress after that. No fixed version is listed for CVE-2026-114570. Review the WordPress advisory and access controls around Contributor-level and Quick Edit until a fix is available; sites with a large number of users are most exposed.

Beyond the patch

Most of the risk this week concentrates in one platform, which makes triage straightforward: patch Frappe first, then Dolibarr, then manage WordPress exposure. Injection and access-control flaws like these are exactly what an Implementation & Assessment Services penetration test and hardening review find first. The open-source supply chain aspect — knowing which versions you run and how quickly each project publishes fixes — fits Supply Chain Defense & Third-Party Risk, since your exposure window is the gap between a maintainer's fix and your update.