Filtered by category: Hacker News, tag: plugin security × Clear
WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution
Matched: WordPress
WordPress has introduced automated security scanning for all plugin updates before distribution via WordPress.org. While new plugins already undergo review before entering the directory, updates previously shipped without similar checks. The system will analyze each release for potential security issues and block high-risk updates before they reach users, closing a long-standing gap in the platform's plugin security process.
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
Matched: WordPress
A critical flaw (CVE-2026-15748, CVSS 9.8) in the Forminator Forms WordPress plugin, installed on over 600,000 sites, allows unauthenticated attackers to upload malicious PHP files and execute arbitrary code remotely. Site owners are urged to update the plugin immediately to mitigate the risk.