Filtered by category: Security Week, tag: unauthenticated attack × Clear
Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Matched: WordPress
Critical unauthenticated remote code execution vulnerabilities have been discovered in The Events Calendar WordPress plugin, which has over 200,000 active installations. The flaws could allow attackers to fully take over affected sites without needing valid credentials. Site owners are urged to update the plugin immediately to a patched version to mitigate the risk.
Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability
Matched: WordPress
A high-severity SQL injection vulnerability, CVE-2026-19949, has been discovered in a WordPress migration plugin used by over 3 million sites. The flaw could allow unauthenticated attackers to execute remote code. Site administrators are urged to update the affected plugin promptly to mitigate potential exploitation.