Filtered by category: WordFence, tag: unauthenticated × Clear
Wordfence Argus Finds Unauthenticated Arbitrary File Upload Vulnerability in Gravity Forms
Matched: WordPress
Wordfence discovered a high-severity arbitrary file upload vulnerability (CVE-2026-19513) in Gravity Forms, a WordPress plugin with over one million installations. Unauthenticated attackers can exploit a cryptographic hash confusion flaw to upload files with attacker-chosen extensions, potentially enabling remote code execution. The flaw was patched in version 3.0.3, released August 20, 2026. Users should update immediately.
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
Matched: WordPress
A critical SQL injection flaw (CVE-2026-19949, CVSS 8.8) was found in the All-in-One WP Migration and Backup WordPress plugin, affecting over 5 million sites. Unauthenticated attackers can plant malicious trackbacks that execute as SQL when an admin performs a backup restore, leaking a secret key and enabling remote code execution. Users should update to version 7.110 immediately. Wordfence Premium users received firewall protection August 16; free users get it September 15.
400,000 WordPress Sites Affected by Account Takeover Vulnerability in TranslatePress WordPress Plugin
Matched: WordPress
A critical vulnerability (CVE-2026-19632, CVSS 9.8) in the TranslatePress WordPress plugin affects over 400,000 sites. Unauthenticated attackers can retrieve an administrator's password reset URL from a secondary-language translation dictionary via a public AJAX endpoint, enabling full account takeover. The flaw only applies when the targeted admin's profile language is set to a published secondary language. Version 3.3.2 patches the issue; users should update immediately.