Filtered by category: Security Week, tag: wordpress × Clear
Critical WordPress Vulnerability Exploited Immediately After Disclosure
Matched: WordPress
A critical WordPress vulnerability, CVE-2026-87902, is being actively exploited immediately following public disclosure. The path traversal flaw allows remote, unauthenticated attackers to execute arbitrary code on affected systems. Site administrators are urged to apply patches immediately, as the rapid exploitation highlights the risk of delays between vulnerability disclosure and remediation.
WordPress Patches ‘Click2Shell’ Vulnerability
Matched: WordPress
WordPress has patched a vulnerability dubbed "Click2Shell" that allows attackers to automatically install and preview themes on a target site. The flaw could ultimately lead to remote code execution. WordPress has released a patch and users are advised to update their installations promptly to mitigate potential exploitation risks.
In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw
Matched: WordPress
A ransomware developer has been sentenced, while a WordPress plugin vulnerability is being actively exploited. Mandiant released its 2026 AI risk report, and a bug bounty hunter was found using PhantomRaven malware. A critical SAP flaw is also drawing attention. An AI-driven attack dubbed Plugin4Shell targets WordPress plugins, and a separate critical SAP vulnerability poses significant enterprise security risks.
Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Matched: WordPress
Critical unauthenticated remote code execution vulnerabilities have been discovered in The Events Calendar WordPress plugin, which has over 200,000 active installations. The flaws could allow attackers to fully take over affected sites without needing valid credentials. Site owners are urged to update the plugin immediately to a patched version to mitigate the risk.