Filtered by category: Security Week × Clear
Critical WordPress Vulnerability Exploited Immediately After Disclosure
Matched: WordPress
A critical WordPress vulnerability, CVE-2026-87902, is being actively exploited immediately following public disclosure. The path traversal flaw allows remote, unauthenticated attackers to execute arbitrary code on affected systems. Site administrators are urged to apply patches immediately, as the rapid exploitation highlights the risk of delays between vulnerability disclosure and remediation.
WordPress Patches ‘Click2Shell’ Vulnerability
Matched: WordPress
WordPress has patched a vulnerability dubbed "Click2Shell" that allows attackers to automatically install and preview themes on a target site. The flaw could ultimately lead to remote code execution. WordPress has released a patch and users are advised to update their installations promptly to mitigate potential exploitation risks.
In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw
Matched: WordPress
A ransomware developer has been sentenced, while a WordPress plugin vulnerability is being actively exploited. Mandiant released its 2026 AI risk report, and a bug bounty hunter was found using PhantomRaven malware. A critical SAP flaw is also drawing attention. An AI-driven attack dubbed Plugin4Shell targets WordPress plugins, and a separate critical SAP vulnerability poses significant enterprise security risks.
Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Matched: WordPress
Critical unauthenticated remote code execution vulnerabilities have been discovered in The Events Calendar WordPress plugin, which has over 200,000 active installations. The flaws could allow attackers to fully take over affected sites without needing valid credentials. Site owners are urged to update the plugin immediately to a patched version to mitigate the risk.
Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites
Matched: WordPress
A critical vulnerability in the Elementor Pro WordPress plugin, CVE-2026-32475, is being actively exploited. Scoring 9.8 on the CVSS scale, the flaw is an arbitrary file upload bug in the plugin's form submission handler, allowing attackers to upload malicious files and potentially take full control of affected websites. Site owners are urged to update immediately.
Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability
Matched: WordPress
A high-severity SQL injection vulnerability, CVE-2026-19949, has been discovered in a WordPress migration plugin used by over 3 million sites. The flaw could allow unauthenticated attackers to execute remote code. Site administrators are urged to update the affected plugin promptly to mitigate potential exploitation.