Filtered by category: Hacker News, tag: remote code execution × Clear
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Matched: WordPress
A critical WordPress vulnerability, CVE-2026-87902 (CVSS 9.2), is being actively exploited within hours of disclosure. The flaw allows unauthenticated attackers to achieve remote code execution by manipulating page-template resolution to include arbitrary local PHP files, requiring no authentication to exploit.
WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
Matched: WordPress
WordPress patched a critical vulnerability in its core software that allows unauthenticated attackers to force a site to load a PHP file from outside its theme folders, potentially enabling remote code execution on some servers. The fix was released September 22 in WordPress 6.7.2 and backported to all supported branches dating to version 4.7. Site owners are urged to update immediately.
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
Matched: WordPress
A WordPress flaw dubbed "Comment2Shell" (CVE-2026-93485) allowed anonymous users to embed malicious scripts in comments. When an admin viewed the page, the script executed server-side code, turning a stored XSS into remote code execution. WordPress patched the issue in version 7.1.1 on September 17 and urged site owners to update immediately.
New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution
Matched: WordPress
installs a theme, but chained with other vulnerabilities it can lead to remote code execution. The flaw affects logged-in administrators who click a malicious link, triggering an unintended theme installation via the WordPress.org directory. WordPress has released patches addressing this and related issues, and users are urged to update immediately.
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
Matched: WordPress
Attackers are exploiting a critical flaw in the WooCommerce Wholesale Lead Capture WordPress plugin, which has over 6,000 active installs. The vulnerability allows unauthenticated attackers to upload arbitrary files, including PHP backdoors, enabling remote code execution. Wordfence has blocked multiple attack attempts targeting the flaw.
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
Matched: WordPress
Over 440,000 exploit attempts have targeted two critical WordPress plugin vulnerabilities: CVE-2026-14894 in Super Forms, allowing unauthenticated attackers to upload arbitrary files, and a flaw in Elementor Pro. Both carry high severity ratings. Wordfence detected the attacks, warning site owners to update affected plugins immediately to prevent potential remote code execution and full site compromise.
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Matched: WordPress
Five critical flaws in WordPress plugins and themes — WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP — could allow attackers to bypass authentication, take over accounts, or execute arbitrary code. Reported by Wordfence and Patchstack, the vulnerabilities carry CVSS scores as high as 9.8. Site owners are urged to update affected components immediately.
Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
Matched: WordPress
A critical flaw (CVE-2026-32475, CVSS 9.0) in the Elementor Pro WordPress plugin allows unauthenticated attackers to upload malicious PHP files and execute remote code. The vulnerability exists in the Forms module's file upload functionality. Users are advised to update the plugin promptly to mitigate risk.
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
Matched: WordPress
A critical flaw (CVE-2026-15748, CVSS 9.8) in the Forminator Forms WordPress plugin, installed on over 600,000 sites, allows unauthenticated attackers to upload malicious PHP files and execute arbitrary code remotely. Site owners are urged to update the plugin immediately to mitigate the risk.