Filtered by category: Hacker News, tag: cve × Clear
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Matched: WordPress
A critical WordPress vulnerability, CVE-2026-87902 (CVSS 9.2), is being actively exploited within hours of disclosure. The flaw allows unauthenticated attackers to achieve remote code execution by manipulating page-template resolution to include arbitrary local PHP files, requiring no authentication to exploit.
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
Matched: WordPress
A WordPress flaw dubbed "Comment2Shell" (CVE-2026-93485) allowed anonymous users to embed malicious scripts in comments. When an admin viewed the page, the script executed server-side code, turning a stored XSS into remote code execution. WordPress patched the issue in version 7.1.1 on September 17 and urged site owners to update immediately.
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
Matched: WordPress
A critical flaw (CVE-2026-15748, CVSS 9.8) in the Forminator Forms WordPress plugin, installed on over 600,000 sites, allows unauthenticated attackers to upload malicious PHP files and execute arbitrary code remotely. Site owners are urged to update the plugin immediately to mitigate the risk.