Filtered by category: Tech Radar × Clear
Hackers are targeting a critical WordPress flaw, so be on your guard
Matched: WordPress
A critical WordPress flaw (CVE-2026-87902), an unauthenticated path traversal bug scored 8.1, allows PHP file inclusion and potential remote code execution. Exploitation began within hours of a patch release, with attackers now writing malicious PHP files to disk across hundreds of IPs. A fix is available in WordPress 7.1.2, backported to version 4.7. Admins unable to update immediately should block traversal sequences in the pagename parameter and disable register_argc_argv.
Third-party WooCommerce plugin hits WordPress sites with PHP backdoor abusing recently patched vulnerability
Matched: WordPress
A critical unauthenticated file-upload vulnerability (CVE-2026-27540) in the WooCommerce Wholesale Lead Capture Plugin is being actively exploited to deploy PHP webshells capable of full site takeover. Affecting versions 2.0.3.1 and older, the flaw was patched in February 2026, but Wordfence has blocked over 100,000 attacks across two surge periods. The plugin has around 20,000 active installations. Users should update to v2.0.3.2 immediately and check upload directories for suspicious PHP files.
Two major security flaws are affecting more than six million WordPress websites
Matched: WordPress
Wordfence has disclosed two critical vulnerabilities in popular WordPress plugins Elementor Pro and Super Forms, putting over six million websites at risk. Both flaws allow unauthenticated attackers to upload executable files, enabling remote code execution. Tracked as CVE-2026-32475 and CVE-2026-14894, each carries a 9.8/10 severity score. Both have been patched, but exploitation attempts have already exceeded 440,000 combined. Users are urged to update immediately.
Experts warn 2,000 hacked WordPress sites were secretly running a global crime ring
Matched: WordPress
Security researchers have discovered around 2,000 compromised WordPress sites being used as infrastructure for a global cybercrime operation. The hacked sites served multiple roles: delivering malware to victims, acting as command-and-control servers for infected devices, and storing stolen data. The operation exploited the sites' legitimate reputations to avoid detection.