Filtered by category: WordFence, tag: remote code execution × Clear
PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core
Matched: WordPress
WordPress released version 7.1.2 on September 22, 2026, patching a critical unauthenticated path traversal vulnerability (CVE-2026-87902) in Core. Security backports were issued for all branches back to 4.7. The flaw lets attackers include arbitrary local PHP files outside the theme directory, potentially enabling remote code execution on sites using themes with a page- subdirectory and accessible PHP files like pearcmd.php. Wordfence Premium users received firewall protection immediately; free users get it October 22.
100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS
Matched: WordPress
A PHP Object Injection vulnerability (CVE-2026-78175, CVSS 8.8) in the Tutor LMS WordPress plugin affects 100,000+ sites running versions 4.0.7 and earlier. Subscriber-level users can achieve remote code execution by exploiting a serialization length-desync bug caused by misuse of esc_sql(), combined with a GuzzleHttp POP chain. Open registration makes exploitation easy. A patch is available in version 4.0.8, released September 10, 2026.
Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability (CVE-2026-27540, CVSS 9.8) in the WooCommerce Wholesale Lead Capture WordPress plugin allows attackers to upload PHP webshells and achieve remote code execution. The flaw exists because file type restrictions rely on attacker-controlled request data. With ~6,000 active installations, Wordfence has blocked over 100,000 exploit attempts. Users should update to version 2.0.3.2 immediately.
Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin
Matched: WordPress
Wordfence discovered two critical unauthenticated remote code execution vulnerability chains in The Events Calendar WordPress plugin, active on over 600,000 sites. Both chains exploit the plugin's widget-rendering pipeline, triggered via pending comment previews without moderator approval, requiring only that comments be enabled on event pages. The first uses PHP Object Injection; the second abuses an arbitrary PHP callable to reset an admin password. Users should update to version 6.17.4.1 immediately.
Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability (CVE-2026-14894, CVSS 9.8) in the WordPress Super Forms plugin affects versions up to 6.3.313. Attackers can upload PHP webshells and achieve remote code execution using just two HTTP requests. The vendor patched the issue in version 6.3.314 on July 8, 2026. Active exploitation began July 14, with over 250,000 blocked attempts recorded. Users should update immediately and check for unexpected PHP files, particularly Mushr00w_upl.php.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)
Matched: WordPress
Wordfence recorded 246 WordPress vulnerabilities across 174 plugins and 5 themes for the week of August 24–30, 2026. Of these, 234 were patched and 12 remain unpatched. Severity breakdown: 18 critical, 73 high, 153 medium, 2 low. Critical issues included unauthenticated remote code execution in Avada and Drag and Drop Multiple File Upload for CF7, authentication bypasses in ManageWP Worker and WPMU DEV Dashboard, and a backdoor in Newspapers X. Firewall rules were immediately deployed for Premium users covering several high-risk flaws.
Attackers Actively Exploiting Critical Vulnerability in Elementor Pro Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability (CVE-2026-32475, CVSS 9.8) in Elementor Pro affects versions up to 4.2.1. A validation loop flaw allows attackers to bypass file type checks and upload executable PHP files, enabling remote code execution. Exploitation requires a published form with a non-required file upload field. Patch 4.2.2 was released August 19, 2026. Wordfence has blocked over 190,000 exploit attempts since disclosure.
Wordfence Argus Finds Unauthenticated Arbitrary File Upload Vulnerability in Gravity Forms
Matched: WordPress
Wordfence discovered a high-severity arbitrary file upload vulnerability (CVE-2026-19513) in Gravity Forms, a WordPress plugin with over one million installations. Unauthenticated attackers can exploit a cryptographic hash confusion flaw to upload files with attacker-chosen extensions, potentially enabling remote code execution. The flaw was patched in version 3.0.3, released August 20, 2026. Users should update immediately.
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
Matched: WordPress
A critical SQL injection flaw (CVE-2026-19949, CVSS 8.8) was found in the All-in-One WP Migration and Backup WordPress plugin, affecting over 5 million sites. Unauthenticated attackers can plant malicious trackbacks that execute as SQL when an admin performs a backup restore, leaking a secret key and enabling remote code execution. Users should update to version 7.110 immediately. Wordfence Premium users received firewall protection August 16; free users get it September 15.
Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales
Matched: WordPress
Wordfence's AI agent Argus discovered a critical unauthenticated remote code execution vulnerability in the Avada WordPress theme and its Fusion Builder plugin, affecting all versions through 7.16 and 3.16 respectively. The exploit chains six weaknesses to allow arbitrary PHP execution without login. Argus found and proved the full chain in roughly two hours. Patches were released August 25, 2026 in Avada 7.16.1 and Fusion Builder 3.16.1.
Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability was patched in Elementor Pro, a WordPress plugin with around 6 million active installations. Discovered July 24, 2026, the flaw allows attackers without credentials to upload executable PHP files, potentially enabling remote code execution and complete site takeover. Users should update immediately.