Filtered by category: Hacker News, tag: web security × Clear
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory
Matched: WordPress
Researchers have uncovered a WordPress backdoor dubbed "SC" that uses multiple persistence mechanisms — including files, the database, and shared memory — to reinstall itself after removal. Dubbed a "self-healing mesh" by Sucuri, the malware uses the SC_ markers in injected content and is designed to survive cleanup attempts by rebuilding itself through redundant infection vectors.
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
Matched: WordPress
A high-severity CSRF flaw in the Elementor WordPress plugin (CVSS 8.8) allows unauthenticated attackers to create rogue admin accounts and take over sites if an administrator clicks a crafted link. No CVE has been assigned yet. Site owners should update the plugin immediately to protect against exploitation.
WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
Matched: WordPress
WordPress patched a critical vulnerability in its core software that allows unauthenticated attackers to force a site to load a PHP file from outside its theme folders, potentially enabling remote code execution on some servers. The fix was released September 22 in WordPress 6.7.2 and backported to all supported branches dating to version 4.7. Site owners are urged to update immediately.
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
Matched: WordPress
A WordPress flaw dubbed "Comment2Shell" (CVE-2026-93485) allowed anonymous users to embed malicious scripts in comments. When an admin viewed the page, the script executed server-side code, turning a stored XSS into remote code execution. WordPress patched the issue in version 7.1.1 on September 17 and urged site owners to update immediately.
New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution
Matched: WordPress
installs a theme, but chained with other vulnerabilities it can lead to remote code execution. The flaw affects logged-in administrators who click a malicious link, triggering an unintended theme installation via the WordPress.org directory. WordPress has released patches addressing this and related issues, and users are urged to update immediately.