Filtered by tag: sql injection × Clear
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)
Matched: WordPress
Wordfence reported 319 WordPress vulnerabilities across 222 plugins for the week of September 21–27, 2026. Of these, 305 were patched and 14 remain unpatched. Fourteen vulnerabilities were rated critical, including unauthenticated privilege escalation, remote code execution, and arbitrary file upload flaws. WordPress core itself received a patch for an unauthenticated local file inclusion bug. Cross-site scripting and missing authorization were the most common vulnerability types. 156 researchers contributed disclosures.
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026)
Matched: WordPress
Wordfence recorded 358 vulnerabilities across 243 WordPress plugins and 4 themes for the week of September 14–20, 2026. Of these, 311 were patched and 47 remain unpatched. Severity breakdown: 18 critical, 74 high, 262 medium, 4 low. Critical issues included backdoored software in Admin Menu Editor Pro, unauthenticated remote code execution in several plugins, authentication bypasses, and arbitrary file uploads. WordPress Core 7.1 received patches for stored XSS and several authorization flaws. 184 researchers contributed disclosures.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)
Matched: WordPress
Wordfence recorded 246 WordPress vulnerabilities across 174 plugins and 5 themes for the week of August 24–30, 2026. Of these, 234 were patched and 12 remain unpatched. Severity breakdown: 18 critical, 73 high, 153 medium, 2 low. Critical issues included unauthenticated remote code execution in Avada and Drag and Drop Multiple File Upload for CF7, authentication bypasses in ManageWP Worker and WPMU DEV Dashboard, and a backdoor in Newspapers X. Firewall rules were immediately deployed for Premium users covering several high-risk flaws.
Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability
Matched: WordPress
A high-severity SQL injection vulnerability, CVE-2026-19949, has been discovered in a WordPress migration plugin used by over 3 million sites. The flaw could allow unauthenticated attackers to execute remote code. Site administrators are urged to update the affected plugin promptly to mitigate potential exploitation.
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
Matched: WordPress
A critical SQL injection flaw (CVE-2026-19949, CVSS 8.8) was found in the All-in-One WP Migration and Backup WordPress plugin, affecting over 5 million sites. Unauthenticated attackers can plant malicious trackbacks that execute as SQL when an admin performs a backup restore, leaking a secret key and enabling remote code execution. Users should update to version 7.110 immediately. Wordfence Premium users received firewall protection August 16; free users get it September 15.
Vulnerability & Patch Roundup — April 2026
Matched: WordPress
Sucuri's April 2026 roundup highlights notable WordPress ecosystem vulnerabilities and available patches. Automated attacks exploiting known software flaws remain a leading cause of website compromises. The report aims to inform website owners of potential threats, with listed vulnerabilities already virtually patched for existing Sucuri Firewall customers.
Vulnerability & Patch Roundup — March 2026
Matched: WordPress
Sucuri's March 2026 vulnerability roundup highlights security patches and disclosures across the WordPress ecosystem. Automated attacks exploiting known vulnerabilities remain a top cause of website compromises. The listed vulnerabilities have been virtually patched via the Sucuri Firewall, protecting existing clients. The roundup aims to help website owners stay informed about potential threats to their environments.