Total Upkeep < 1.17.3 - Unauthenticated Sensitive Data Disclosure and Forced Site Restore via Predictable cron_secret

Why this deserves its current priority

CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Unknown/Total Upkeep (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Unknown/Total Upkeep.
2. 2Review the reported fix. Update Unknown/Total Upkeep to 1.17.3 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Aug 12, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 3, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Aug 12, 2026

Sources and claim methodology

• Source referencewpscan.com

Related CVEs

• HDD Password Stored In PlaintextSame generic ecosystem
• SysPasswordDxe: Password hashes are exposed in runtime UEFI variables, leading to escalation of privilegeSame generic ecosystem
• VariableEditSmm: Error checking of UEFI variables could cause buffer overflow, leading to code executionSame generic ecosystem
• GutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'Same generic ecosystem
• Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode ParameterSame generic ecosystem
• KVM: x86/mmu: WARN and clear role.invalid when creating a child shadow pageSame generic ecosystem