Filtered by tag: wordpress × Clear
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory
Matched: WordPress
Researchers have uncovered a WordPress backdoor dubbed "SC" that uses multiple persistence mechanisms — including files, the database, and shared memory — to reinstall itself after removal. Dubbed a "self-healing mesh" by Sucuri, the malware uses the SC_ markers in injected content and is designed to survive cleanup attempts by rebuilding itself through redundant infection vectors.
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
Matched: WordPress
A high-severity CSRF flaw in the Elementor WordPress plugin (CVSS 8.8) allows unauthenticated attackers to create rogue admin accounts and take over sites if an administrator clicks a crafted link. No CVE has been assigned yet. Site owners should update the plugin immediately to protect against exploitation.
Hackers are targeting a critical WordPress flaw, so be on your guard
Matched: WordPress
A critical WordPress flaw (CVE-2026-87902), an unauthenticated path traversal bug scored 8.1, allows PHP file inclusion and potential remote code execution. Exploitation began within hours of a patch release, with attackers now writing malicious PHP files to disk across hundreds of IPs. A fix is available in WordPress 7.1.2, backported to version 4.7. Admins unable to update immediately should block traversal sequences in the pagename parameter and disable register_argc_argv.
Critical WordPress Vulnerability Exploited Immediately After Disclosure
Matched: WordPress
A critical WordPress vulnerability, CVE-2026-87902, is being actively exploited immediately following public disclosure. The path traversal flaw allows remote, unauthenticated attackers to execute arbitrary code on affected systems. Site administrators are urged to apply patches immediately, as the rapid exploitation highlights the risk of delays between vulnerability disclosure and remediation.
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Matched: WordPress
A critical WordPress vulnerability, CVE-2026-87902 (CVSS 9.2), is being actively exploited within hours of disclosure. The flaw allows unauthenticated attackers to achieve remote code execution by manipulating page-template resolution to include arbitrary local PHP files, requiring no authentication to exploit.
WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
Matched: WordPress
WordPress patched a critical vulnerability in its core software that allows unauthenticated attackers to force a site to load a PHP file from outside its theme folders, potentially enabling remote code execution on some servers. The fix was released September 22 in WordPress 6.7.2 and backported to all supported branches dating to version 4.7. Site owners are urged to update immediately.
WordPress Patches ‘Click2Shell’ Vulnerability
Matched: WordPress
WordPress has patched a vulnerability dubbed "Click2Shell" that allows attackers to automatically install and preview themes on a target site. The flaw could ultimately lead to remote code execution. WordPress has released a patch and users are advised to update their installations promptly to mitigate potential exploitation risks.
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
Matched: WordPress
A WordPress flaw dubbed "Comment2Shell" (CVE-2026-93485) allowed anonymous users to embed malicious scripts in comments. When an admin viewed the page, the script executed server-side code, turning a stored XSS into remote code execution. WordPress patched the issue in version 7.1.1 on September 17 and urged site owners to update immediately.
New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution
Matched: WordPress
installs a theme, but chained with other vulnerabilities it can lead to remote code execution. The flaw affects logged-in administrators who click a malicious link, triggering an unintended theme installation via the WordPress.org directory. WordPress has released patches addressing this and related issues, and users are urged to update immediately.
In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw
Matched: WordPress
A ransomware developer has been sentenced, while a WordPress plugin vulnerability is being actively exploited. Mandiant released its 2026 AI risk report, and a bug bounty hunter was found using PhantomRaven malware. A critical SAP flaw is also drawing attention. An AI-driven attack dubbed Plugin4Shell targets WordPress plugins, and a separate critical SAP vulnerability poses significant enterprise security risks.
PHP Webshell Campaign Targets WordPress Through Critical WooCommerce Plugin Bug
Matched: WordPress
Attackers are exploiting a critical vulnerability in a third-party WooCommerce plugin to upload PHP webshells onto WordPress sites, gaining persistent backdoor access. The flaw allows unauthenticated file uploads, enabling remote code execution. Site owners are urged to update the affected plugin immediately and scan for indicators of compromise, including suspicious PHP files in upload directories.
Third-party WooCommerce plugin hits WordPress sites with PHP backdoor abusing recently patched vulnerability
Matched: WordPress
A critical unauthenticated file-upload vulnerability (CVE-2026-27540) in the WooCommerce Wholesale Lead Capture Plugin is being actively exploited to deploy PHP webshells capable of full site takeover. Affecting versions 2.0.3.1 and older, the flaw was patched in February 2026, but Wordfence has blocked over 100,000 attacks across two surge periods. The plugin has around 20,000 active installations. Users should update to v2.0.3.2 immediately and check upload directories for suspicious PHP files.
Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Matched: WordPress
Critical unauthenticated remote code execution vulnerabilities have been discovered in The Events Calendar WordPress plugin, which has over 200,000 active installations. The flaws could allow attackers to fully take over affected sites without needing valid credentials. Site owners are urged to update the plugin immediately to a patched version to mitigate the risk.
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
Matched: WordPress
Attackers are exploiting a critical flaw in the WooCommerce Wholesale Lead Capture WordPress plugin, which has over 6,000 active installs. The vulnerability allows unauthenticated attackers to upload arbitrary files, including PHP backdoors, enabling remote code execution. Wordfence has blocked multiple attack attempts targeting the flaw.
WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution
Matched: WordPress
WordPress has introduced automated security scanning for all plugin updates before distribution via WordPress.org. While new plugins already undergo review before entering the directory, updates previously shipped without similar checks. The system will analyze each release for potential security issues and block high-risk updates before they reach users, closing a long-standing gap in the platform's plugin security process.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)
Matched: WordPress
Wordfence disclosed 277 WordPress vulnerabilities across 187 plugins and 7 themes for the week of August 31–September 6, 2026. Sixteen were critical (CVSS 9.8), including unauthenticated privilege escalation, remote code execution, and arbitrary file upload flaws in plugins like Hummingbird, JetFormBuilder, Mail Mint, and MemberDash. Most vulnerabilities were patched; 23 remain unpatched. Cross-site scripting and missing authorization were the most common vulnerability types.
Two major security flaws are affecting more than six million WordPress websites
Matched: WordPress
Wordfence has disclosed two critical vulnerabilities in popular WordPress plugins Elementor Pro and Super Forms, putting over six million websites at risk. Both flaws allow unauthenticated attackers to upload executable files, enabling remote code execution. Tracked as CVE-2026-32475 and CVE-2026-14894, each carries a 9.8/10 severity score. Both have been patched, but exploitation attempts have already exceeded 440,000 combined. Users are urged to update immediately.
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
Matched: WordPress
Over 440,000 exploit attempts have targeted two critical WordPress plugin vulnerabilities: CVE-2026-14894 in Super Forms, allowing unauthenticated attackers to upload arbitrary files, and a flaw in Elementor Pro. Both carry high severity ratings. Wordfence detected the attacks, warning site owners to update affected plugins immediately to prevent potential remote code execution and full site compromise.
Vulnerability & Patch Roundup — August 2026
Matched: WordPress
Security researchers have compiled August 2026's key vulnerability patches for the WordPress ecosystem. Most breaches stem from automated attacks exploiting previously disclosed, known vulnerabilities. Unpatched flaws can take sites offline, damage reputations, or require costly remediation. The monthly roundup aims to help site owners maintain their security posture by staying current on critical updates.
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Matched: WordPress
Five critical flaws in WordPress plugins and themes — WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP — could allow attackers to bypass authentication, take over accounts, or execute arbitrary code. Reported by Wordfence and Patchstack, the vulnerabilities carry CVSS scores as high as 9.8. Site owners are urged to update affected components immediately.
Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
Matched: WordPress
Attackers are exploiting two critical authentication bypass flaws in the miniOrange SAML 2.0 Single Sign On WordPress plugin. The vulnerabilities, tracked as CVE-2026-61979 and assigned a CVSS score of 8.1, allow unauthenticated attackers to log in as any WordPress user, including administrators. The flaws were disclosed by Patchstack, and active exploitation attempts have already been observed.
Experts warn 2,000 hacked WordPress sites were secretly running a global crime ring
Matched: WordPress
Security researchers have discovered around 2,000 compromised WordPress sites being used as infrastructure for a global cybercrime operation. The hacked sites served multiple roles: delivering malware to victims, acting as command-and-control servers for infected devices, and storing stolen data. The operation exploited the sites' legitimate reputations to avoid detection.
Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
Matched: WordPress
A critical flaw (CVE-2026-32475, CVSS 9.0) in the Elementor Pro WordPress plugin allows unauthenticated attackers to upload malicious PHP files and execute remote code. The vulnerability exists in the Forms module's file upload functionality. Users are advised to update the plugin promptly to mitigate risk.
StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
Matched: WordPress
A cybercrime operation called StopAndProtect has compromised nearly 2,000 WordPress sites to distribute malware and collect stolen data. Rather than using a single malware strain, the campaign deploys a full toolkit of criminal software, using the hacked sites as infrastructure to spread infections, control compromised systems, and store stolen documents, screenshots, and activity logs.
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
Matched: WordPress
A critical flaw (CVE-2026-15748, CVSS 9.8) in the Forminator Forms WordPress plugin, installed on over 600,000 sites, allows unauthenticated attackers to upload malicious PHP files and execute arbitrary code remotely. Site owners are urged to update the plugin immediately to mitigate the risk.