Filtered by tag: plugin vulnerability × Clear
Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Matched: WordPress
Critical unauthenticated remote code execution vulnerabilities have been discovered in The Events Calendar WordPress plugin, which has over 200,000 active installations. The flaws could allow attackers to fully take over affected sites without needing valid credentials. Site owners are urged to update the plugin immediately to a patched version to mitigate the risk.
40,000 WordPress Sites affected by Authentication Bypass Vulnerability in User Profile Builder WordPress Plugin
Matched: WordPress
A critical authentication bypass vulnerability was found in the User Profile Builder WordPress plugin, affecting over 40,000 sites. Reported July 14, 2026, the flaw allows unauthenticated attackers to log in as the primary administrator (user ID 1), enabling full site takeover. The vulnerability is only exploitable when the plugin's "Automatically Log In" setting is enabled.