SecurityWordPress 7.1.2 Patches Critical LFI-to-RCE Flaw
WordPress fixed a critical flaw in versions 4.7.0 through 7.1.1 that can lead to code execution on servers lacking a page-prefixed theme folder and register_argc_argv off.
> Search
27 results for “wordpress”
Security
Cyber CrimeCopycat ClickFix Kit Built on Rival's Code
Sekoia says the Exvicy framework reuses ErrTraffic's code and has been spotted delivering malware via compromised WordPress sites.
SecurityClick2Shell Turns Admin Clicks Into Theme Installs
A new WordPress core flaw lets a crafted link silently install a theme, and researchers chained it to full code execution.
SecurityOne Week, Nine Flaws, No Easy Fix
SecurityWeek's roundup covers a ransomware sentencing, a zero-click AI plugin flaw, and a critical SAP bug under active scrutiny.
Cyber CrimeBrevo Breach Turns CDN Edge Into Attack Path
A hardcoded Cloudflare key let attackers rewrite Brevo's sites and customer scripts for hours, pushing ClickFix malware at scale.
SecurityWooCommerce Plugin Flaw Fuels Web Shell Attacks
Attackers are exploiting a critical WooCommerce Wholesale Lead Capture vulnerability to upload PHP web shells and achieve remote code execution.
Tech NewsMullenweg Backs Board's Failed Automattic Coup
Automattic confirms Matt Mullenweg has returned as CEO after the board's attempt to oust him unraveled in under a week.
Tech NewsAutomattic's board pushes Mullenweg out
Automattic's board placed CEO Matt Mullenweg on paid leave and named CFO Mark Davies interim CEO, according to a Slack message seen by TechCrunch.
SecurityElementor Pro Flaw Exploited in the Wild
Attackers are actively exploiting a critical file upload bug in the popular Elementor Pro WordPress plugin.
SecurityGiveWP flaw opens server to unauthenticated takeover
A critical GiveWP plugin bug chains three issues, letting attackers run commands on WordPress servers with no account needed.
SecurityZero-click RCE in Avada leaves million sites exposed
A 9.8-rated flaw chain in the Avada WordPress theme lets unauthenticated attackers run PHP code.
SecuritySilent Patch Leaves WordPress Admins Exposed
Critical MiniOrange SAML SSO flaws exploited in wild; silent patch raises risk for WordPress sites.
SecurityWordPress Plugin Flaw Opens Door to Admin Takeover
CVE-2026-15826 in User Profile Builder exposes 40,000+ WordPress sites to admin takeover.
SecuritySupply chain compromise uses poisoned API, no files changed
Attackers planted rogue admins and webshells on WordPress sites via a poisoned data feed, not file changes.
SecurityCritical WordPress AI Copilot Flaw Found
A critical authorization bypass in the AI Copilot plugin allows unauthenticated attackers to create administrator accounts and seize full control of websites.
SecurityTrueBooker WordPress Plugin Critical Flaw
A critical authorization bypass vulnerability in the TrueBooker plugin allows unauthenticated attackers to reset passwords for any user, including administrators.
SecurityCritical Auth Bypass Found in TNG Plugin
A critical vulnerability in the Single Sign On For TNG WordPress plugin allows unauthenticated attackers to reset any user password and take over sites.
SecurityCISA Warns of Actively Exploited WordPress Flaw
WordPress Core is under active attack via an interpretation conflict vulnerability that allows for SQL injection and remote code execution.
SecurityCISA Adds WordPress SQL Injection to KEV List
WordPress Core is currently under active exploitation via a SQL injection vulnerability that can be chained to achieve remote code execution.
SecurityEasy Form Builder Flaw Allows Takeover
A critical vulnerability in a WordPress plugin allows unauthenticated users to gain full administrator access to affected websites.
SecurityWP2Shell Flaws Force Rapid WordPress Patch
A pair of newly identified vulnerabilities dubbed WP2Shell are being actively exploited in the wild, triggering forced site updates.
SecurityWordPress Core Flaws Risk Unauth Access
A dual-vulnerability chain allows unauthenticated code execution on WordPress core installations, prompting emergency updates.
SecurityBricksforge Plugin Vulnerability Exposed
A critical privilege escalation flaw in the Bricksforge plugin allows unauthenticated attackers to create new administrator accounts.
SecurityAimogen Pro Vulnerability Allows Access
A critical privilege escalation flaw in the Aimogen Pro WordPress plugin could permit unauthenticated administrative access.
SecurityCritical Privilege Escalation Flaw Found in Bricksforge WordPress Plugin
A critical vulnerability in the Bricksforge WordPress plugin allows unauthenticated attackers to create unauthorized administrator accounts.
SecurityAutomated Zero-Day Discovery via AI
Researchers are moving beyond theoretical AI capabilities, building automated pipelines to find live vulnerabilities in software.
SecurityStealthy Webshell Attacks Target Vulnerable CMS Platforms
As an automated, potentially AI-assisted campaign scans for flawed plugins, small businesses face a severe rise in stealthy webshell attacks.