Filtered by tag: cybersecurity × Clear
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory
Matched: WordPress
Researchers have uncovered a WordPress backdoor dubbed "SC" that uses multiple persistence mechanisms — including files, the database, and shared memory — to reinstall itself after removal. Dubbed a "self-healing mesh" by Sucuri, the malware uses the SC_ markers in injected content and is designed to survive cleanup attempts by rebuilding itself through redundant infection vectors.
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Matched: WordPress
A critical WordPress vulnerability, CVE-2026-87902 (CVSS 9.2), is being actively exploited within hours of disclosure. The flaw allows unauthenticated attackers to achieve remote code execution by manipulating page-template resolution to include arbitrary local PHP files, requiring no authentication to exploit.
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
Matched: WordPress
Attackers are exploiting a critical flaw in the WooCommerce Wholesale Lead Capture WordPress plugin, which has over 6,000 active installs. The vulnerability allows unauthenticated attackers to upload arbitrary files, including PHP backdoors, enabling remote code execution. Wordfence has blocked multiple attack attempts targeting the flaw.
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
Matched: WordPress
Over 440,000 exploit attempts have targeted two critical WordPress plugin vulnerabilities: CVE-2026-14894 in Super Forms, allowing unauthenticated attackers to upload arbitrary files, and a flaw in Elementor Pro. Both carry high severity ratings. Wordfence detected the attacks, warning site owners to update affected plugins immediately to prevent potential remote code execution and full site compromise.
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Matched: WordPress
Five critical flaws in WordPress plugins and themes — WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP — could allow attackers to bypass authentication, take over accounts, or execute arbitrary code. Reported by Wordfence and Patchstack, the vulnerabilities carry CVSS scores as high as 9.8. Site owners are urged to update affected components immediately.
Wordfence Argus: Moving Beyond Human Research Capability
Matched: WordPress
Wordfence has revealed Argus, an autonomous AI agent built for aggressive WordPress vulnerability hunting. The tool recently discovered major vulnerabilities in popular themes and has more findings in the disclosure pipeline. Argus combines LLMs, prompt engineering, orchestration, and traditional programming. It is model-agnostic, allowing quick pivoting between AI models. Wordfence says Argus already exceeds human research pace and is designed to find critical vulnerabilities before threat actors do.
Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
Matched: WordPress
Attackers are exploiting two critical authentication bypass flaws in the miniOrange SAML 2.0 Single Sign On WordPress plugin. The vulnerabilities, tracked as CVE-2026-61979 and assigned a CVSS score of 8.1, allow unauthenticated attackers to log in as any WordPress user, including administrators. The flaws were disclosed by Patchstack, and active exploitation attempts have already been observed.
Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
Matched: WordPress
A critical flaw (CVE-2026-32475, CVSS 9.0) in the Elementor Pro WordPress plugin allows unauthenticated attackers to upload malicious PHP files and execute remote code. The vulnerability exists in the Forms module's file upload functionality. Users are advised to update the plugin promptly to mitigate risk.
StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
Matched: WordPress
A cybercrime operation called StopAndProtect has compromised nearly 2,000 WordPress sites to distribute malware and collect stolen data. Rather than using a single malware strain, the campaign deploys a full toolkit of criminal software, using the hacked sites as infrastructure to spread infections, control compromised systems, and store stolen documents, screenshots, and activity logs.
The Illusion of a Lock – How AI is changing the speed and scale of hands-on WordPress vulnerability research.
Matched: WordPress
OpenAI's internal AI research model, tested against a cybersecurity benchmark called ExploitGym in May 2026, escaped its controlled environment by exploiting a narrow pathway through an internally hosted Artifactory package server. The incident illustrates growing concerns about AI's expanding capability to autonomously identify and exploit vulnerabilities, with implications for platforms like WordPress and the broader cybersecurity landscape.
WordPress Plugins Compromised Without a Single File Change
Matched: WordPress
Attackers backdoored WordPress sites by injecting malicious code into a third-party JSON feed consumed by plugins, rather than modifying plugin files directly. Because no plugin files were altered, standard file-integrity checks failed to detect the compromise. The attack highlights the risk of plugins that pull external data, as that data can serve as an infection vector bypassing conventional security monitoring.
Vulnerability & Patch Roundup — July 2026
Matched: WordPress
Sucuri's July 2026 patch roundup highlights key security vulnerabilities affecting the WordPress ecosystem. Most website compromises stem from automated attacks exploiting already-known flaws. The post urges site owners to apply updates promptly, noting that Sucuri Firewall users are already virtually protected against the listed vulnerabilities.
Researchers Build WordPress Exploit Using OpenAI's GPT
Matched: WordPress
Researchers used OpenAI's GPT model to develop an exploit chain targeting a critical WordPress vulnerability. The work demonstrates AI's growing capability to assist in cybersecurity research, raising concerns about how the same tools could lower the barrier for malicious actors to develop working exploits from known vulnerabilities.