Filtered by category: Hacker News, tag: wordpress × Clear
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory
Matched: WordPress
Researchers have uncovered a WordPress backdoor dubbed "SC" that uses multiple persistence mechanisms — including files, the database, and shared memory — to reinstall itself after removal. Dubbed a "self-healing mesh" by Sucuri, the malware uses the SC_ markers in injected content and is designed to survive cleanup attempts by rebuilding itself through redundant infection vectors.
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
Matched: WordPress
A high-severity CSRF flaw in the Elementor WordPress plugin (CVSS 8.8) allows unauthenticated attackers to create rogue admin accounts and take over sites if an administrator clicks a crafted link. No CVE has been assigned yet. Site owners should update the plugin immediately to protect against exploitation.
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Matched: WordPress
A critical WordPress vulnerability, CVE-2026-87902 (CVSS 9.2), is being actively exploited within hours of disclosure. The flaw allows unauthenticated attackers to achieve remote code execution by manipulating page-template resolution to include arbitrary local PHP files, requiring no authentication to exploit.
WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
Matched: WordPress
WordPress patched a critical vulnerability in its core software that allows unauthenticated attackers to force a site to load a PHP file from outside its theme folders, potentially enabling remote code execution on some servers. The fix was released September 22 in WordPress 6.7.2 and backported to all supported branches dating to version 4.7. Site owners are urged to update immediately.
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
Matched: WordPress
A WordPress flaw dubbed "Comment2Shell" (CVE-2026-93485) allowed anonymous users to embed malicious scripts in comments. When an admin viewed the page, the script executed server-side code, turning a stored XSS into remote code execution. WordPress patched the issue in version 7.1.1 on September 17 and urged site owners to update immediately.
New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution
Matched: WordPress
installs a theme, but chained with other vulnerabilities it can lead to remote code execution. The flaw affects logged-in administrators who click a malicious link, triggering an unintended theme installation via the WordPress.org directory. WordPress has released patches addressing this and related issues, and users are urged to update immediately.
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
Matched: WordPress
Attackers are exploiting a critical flaw in the WooCommerce Wholesale Lead Capture WordPress plugin, which has over 6,000 active installs. The vulnerability allows unauthenticated attackers to upload arbitrary files, including PHP backdoors, enabling remote code execution. Wordfence has blocked multiple attack attempts targeting the flaw.
WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution
Matched: WordPress
WordPress has introduced automated security scanning for all plugin updates before distribution via WordPress.org. While new plugins already undergo review before entering the directory, updates previously shipped without similar checks. The system will analyze each release for potential security issues and block high-risk updates before they reach users, closing a long-standing gap in the platform's plugin security process.
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
Matched: WordPress
Over 440,000 exploit attempts have targeted two critical WordPress plugin vulnerabilities: CVE-2026-14894 in Super Forms, allowing unauthenticated attackers to upload arbitrary files, and a flaw in Elementor Pro. Both carry high severity ratings. Wordfence detected the attacks, warning site owners to update affected plugins immediately to prevent potential remote code execution and full site compromise.
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Matched: WordPress
Five critical flaws in WordPress plugins and themes — WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP — could allow attackers to bypass authentication, take over accounts, or execute arbitrary code. Reported by Wordfence and Patchstack, the vulnerabilities carry CVSS scores as high as 9.8. Site owners are urged to update affected components immediately.
Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
Matched: WordPress
Attackers are exploiting two critical authentication bypass flaws in the miniOrange SAML 2.0 Single Sign On WordPress plugin. The vulnerabilities, tracked as CVE-2026-61979 and assigned a CVSS score of 8.1, allow unauthenticated attackers to log in as any WordPress user, including administrators. The flaws were disclosed by Patchstack, and active exploitation attempts have already been observed.
Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
Matched: WordPress
A critical flaw (CVE-2026-32475, CVSS 9.0) in the Elementor Pro WordPress plugin allows unauthenticated attackers to upload malicious PHP files and execute remote code. The vulnerability exists in the Forms module's file upload functionality. Users are advised to update the plugin promptly to mitigate risk.
StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
Matched: WordPress
A cybercrime operation called StopAndProtect has compromised nearly 2,000 WordPress sites to distribute malware and collect stolen data. Rather than using a single malware strain, the campaign deploys a full toolkit of criminal software, using the hacked sites as infrastructure to spread infections, control compromised systems, and store stolen documents, screenshots, and activity logs.
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
Matched: WordPress
A critical flaw (CVE-2026-15748, CVSS 9.8) in the Forminator Forms WordPress plugin, installed on over 600,000 sites, allows unauthenticated attackers to upload malicious PHP files and execute arbitrary code remotely. Site owners are urged to update the plugin immediately to mitigate the risk.