SecurityGiveWP flaw opens server to unauthenticated takeover
A critical GiveWP plugin bug chains three issues, letting attackers run commands on WordPress servers with no account needed.
> Search
18 results for “wordpress”
Security
SecurityZero-click RCE in Avada leaves million sites exposed
A 9.8-rated flaw chain in the Avada WordPress theme lets unauthenticated attackers run PHP code.
SecuritySilent Patch Leaves WordPress Admins Exposed
Critical MiniOrange SAML SSO flaws exploited in wild; silent patch raises risk for WordPress sites.
SecurityWordPress Plugin Flaw Opens Door to Admin Takeover
CVE-2026-15826 in User Profile Builder exposes 40,000+ WordPress sites to admin takeover.
SecuritySupply chain compromise uses poisoned API, no files changed
Attackers planted rogue admins and webshells on WordPress sites via a poisoned data feed, not file changes.
SecurityCritical WordPress AI Copilot Flaw Found
A critical authorization bypass in the AI Copilot plugin allows unauthenticated attackers to create administrator accounts and seize full control of websites.
SecurityTrueBooker WordPress Plugin Critical Flaw
A critical authorization bypass vulnerability in the TrueBooker plugin allows unauthenticated attackers to reset passwords for any user, including administrators.
SecurityCritical Auth Bypass Found in TNG Plugin
A critical vulnerability in the Single Sign On For TNG WordPress plugin allows unauthenticated attackers to reset any user password and take over sites.
SecurityCISA Warns of Actively Exploited WordPress Flaw
WordPress Core is under active attack via an interpretation conflict vulnerability that allows for SQL injection and remote code execution.
SecurityCISA Adds WordPress SQL Injection to KEV List
WordPress Core is currently under active exploitation via a SQL injection vulnerability that can be chained to achieve remote code execution.
SecurityEasy Form Builder Flaw Allows Takeover
A critical vulnerability in a WordPress plugin allows unauthenticated users to gain full administrator access to affected websites.
SecurityWP2Shell Flaws Force Rapid WordPress Patch
A pair of newly identified vulnerabilities dubbed WP2Shell are being actively exploited in the wild, triggering forced site updates.
SecurityWordPress Core Flaws Risk Unauth Access
A dual-vulnerability chain allows unauthenticated code execution on WordPress core installations, prompting emergency updates.
SecurityBricksforge Plugin Vulnerability Exposed
A critical privilege escalation flaw in the Bricksforge plugin allows unauthenticated attackers to create new administrator accounts.
SecurityAimogen Pro Vulnerability Allows Access
A critical privilege escalation flaw in the Aimogen Pro WordPress plugin could permit unauthenticated administrative access.
SecurityCritical Privilege Escalation Flaw Found in Bricksforge WordPress Plugin
A critical vulnerability in the Bricksforge WordPress plugin allows unauthenticated attackers to create unauthorized administrator accounts.
SecurityAutomated Zero-Day Discovery via AI
Researchers are moving beyond theoretical AI capabilities, building automated pipelines to find live vulnerabilities in software.
SecurityStealthy Webshell Attacks Target Vulnerable CMS Platforms
As an automated, potentially AI-assisted campaign scans for flawed plugins, small businesses face a severe rise in stealthy webshell attacks.