Stories tagged “Wordpress.”
30 stories
Critical vulnerability in Avada WordPress theme can be exploited for arbitrary PHP code execution. CVE-2026-18431 affects Avada versions up to 7.16 and Fusion Builder plugin versions up to 3.16.
Attackers are exploiting two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin, allowing them to sign in as any WordPress user, including administrators. The vulnerabilities, disclosed by Patchstack, are due to signat…
Hackers are attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. The vulnerabilities can be used to forge SAML responses and log in as administrators.
Elementor Pro plugin flaw allows attackers to execute arbitrary code on servers.
A critical flaw in the Elementor Pro WordPress plugin, CVE-2026-32475, allows unauthenticated attackers to upload dangerous PHP files and achieve remote code execution.
Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, store stolen documents, screenshots, and activity logs created to track the status …
A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites.
WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. The flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with …
Many WordPress website operators are unaware that the platform's powerful JSON API can expose sensitive data without requiring a login, bypassing frontend authentication.
A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck. The vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill's …
Hackers are exploiting the wp2shell critical vulnerability suite affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers.
Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites.
WordPress Core has been hit with critical 'wp2shell' remote code execution vulnerabilities, tracked as CVE-2026-63030 and CVE-2026-60137. Public exploits have been released, making it essential for administrators to patch their sites immediately.
Researchers at Intruder used AI tokens to find a zero-day vulnerability in a popular WordPress plugin, demonstrating the potential of AI in vulnerability research.
WordPress has released a new Apple TV app called WordPress TV, which brings thousands of free videos to the big screen. The app features talks, tutorials, and WordCamp session recordings from WordPress meetups and events worldwide.
A cybercrime crew left a server open on the internet for three weeks, exposing its hacking tools, activity logs, and target lists naming over 1.4 million websites. The operation, tracked as WP-SHELLSTORM, is a webshell access brokerage that breaks into sites at scale, pla…
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack, affecting Pro plugin builds distributed through the vendor's Easy Digital Downloads infrastructure. The compromised plugins incorporate a loader that fetches a payload from a remote se…
Hackers are exploiting a vulnerability in the Gravity SMTP WordPress plugin to expose API keys and other sensitive data. The flaw, tracked as CVE-2026-4020, affects around 100,000 sites.
An international police operation, part of 'Operation Endgame,' has dismantled a Russian-linked cybercrime network, cleaning nearly 15,000 infected WordPress sites globally.
Hackers are exploiting a vulnerability in the Gravity SMTP WordPress plugin, affecting 100,000 sites. The flaw allows unauthenticated access to sensitive information.
Dutch law enforcement, along with international counterparts, has disrupted SocGholish malware infrastructure and cleaned nearly 15,000 infected WordPress sites. The operation is part of an ongoing initiative to combat botnets and associated criminal infrastructures.
Multiple ShapedPlugin plugins were compromised in a supply chain attack that infected paying customers via official update system. Security incident affected three paid plugins.
A survey by WordPress VIP found that 60% of U.S. consumers are turned off by brands using 'AI' in their messaging, and 86% don't fully trust AI-generated answers. Consumers value transparency and attribution, with 33% saying clicking through to see an original source is t…
OptinMonster and TrustPulse plugins compromised in CDN supply-chain attack. Awesome Motive's CDN used by OptinMonster, TrustPulse, and PushEngage impacted.
An attacker tampered with JavaScript files used by WordPress sites running PushEngage, OptinMonster, and TrustPulse, creating a hidden backdoor. Sites that loaded the malicious script should be treated as compromised.
Attackers are exploiting a critical Everest Forms Pro bug to run PHP on WordPress sites and create rogue admin accounts. Wordfence says more than 29,300 attempts were blocked.
Hackers are exploiting a critical Everest Forms Pro bug to run code on WordPress sites. The same article also details Stripe-abusing skimmer campaigns and a fake storefront network.
Hackers are exploiting a critical Kirki plugin flaw to take over WordPress accounts, including admins. Wordfence blocked more than 222 attack attempts in 24 hours.
Nearly 2,000 WordPress sites were infected by malware that hides C2 data in Steam profile comments using invisible Unicode characters.
A critical WP Maps Pro bug lets unauthenticated attackers create admin accounts. Wordfence says it has already blocked thousands of attack attempts.