Filtered by category: WordFence, tag: wordfence argus × Clear
100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS
Matched: WordPress
A PHP Object Injection vulnerability (CVE-2026-78175, CVSS 8.8) in the Tutor LMS WordPress plugin affects 100,000+ sites running versions 4.0.7 and earlier. Subscriber-level users can achieve remote code execution by exploiting a serialization length-desync bug caused by misuse of esc_sql(), combined with a GuzzleHttp POP chain. Open registration makes exploitation easy. A patch is available in version 4.0.8, released September 10, 2026.
Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin
Matched: WordPress
Wordfence discovered two critical unauthenticated remote code execution vulnerability chains in The Events Calendar WordPress plugin, active on over 600,000 sites. Both chains exploit the plugin's widget-rendering pipeline, triggered via pending comment previews without moderator approval, requiring only that comments be enabled on event pages. The first uses PHP Object Injection; the second abuses an arbitrary PHP callable to reset an admin password. Users should update to version 6.17.4.1 immediately.
Wordfence Argus Finds Unauthenticated Arbitrary File Upload Vulnerability in Gravity Forms
Matched: WordPress
Wordfence discovered a high-severity arbitrary file upload vulnerability (CVE-2026-19513) in Gravity Forms, a WordPress plugin with over one million installations. Unauthenticated attackers can exploit a cryptographic hash confusion flaw to upload files with attacker-chosen extensions, potentially enabling remote code execution. The flaw was patched in version 3.0.3, released August 20, 2026. Users should update immediately.