Filtered by tag: file upload vulnerability × Clear
Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability (CVE-2026-27540, CVSS 9.8) in the WooCommerce Wholesale Lead Capture WordPress plugin allows attackers to upload PHP webshells and achieve remote code execution. The flaw exists because file type restrictions rely on attacker-controlled request data. With ~6,000 active installations, Wordfence has blocked over 100,000 exploit attempts. Users should update to version 2.0.3.2 immediately.
Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites
Matched: WordPress
A critical vulnerability in the Elementor Pro WordPress plugin, CVE-2026-32475, is being actively exploited. Scoring 9.8 on the CVSS scale, the flaw is an arbitrary file upload bug in the plugin's form submission handler, allowing attackers to upload malicious files and potentially take full control of affected websites. Site owners are urged to update immediately.
Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability (CVE-2026-14894, CVSS 9.8) in the WordPress Super Forms plugin affects versions up to 6.3.313. Attackers can upload PHP webshells and achieve remote code execution using just two HTTP requests. The vendor patched the issue in version 6.3.314 on July 8, 2026. Active exploitation began July 14, with over 250,000 blocked attempts recorded. Users should update immediately and check for unexpected PHP files, particularly Mushr00w_upl.php.
Attackers Actively Exploiting Critical Vulnerability in Elementor Pro Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability (CVE-2026-32475, CVSS 9.8) in Elementor Pro affects versions up to 4.2.1. A validation loop flaw allows attackers to bypass file type checks and upload executable PHP files, enabling remote code execution. Exploitation requires a published form with a non-required file upload field. Patch 4.2.2 was released August 19, 2026. Wordfence has blocked over 190,000 exploit attempts since disclosure.