Filtered by tag: themes × Clear
WordPress Patches ‘Click2Shell’ Vulnerability
Matched: WordPress
WordPress has patched a vulnerability dubbed "Click2Shell" that allows attackers to automatically install and preview themes on a target site. The flaw could ultimately lead to remote code execution. WordPress has released a patch and users are advised to update their installations promptly to mitigate potential exploitation risks.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)
Matched: WordPress
Wordfence disclosed 277 WordPress vulnerabilities across 187 plugins and 7 themes for the week of August 31–September 6, 2026. Sixteen were critical (CVSS 9.8), including unauthenticated privilege escalation, remote code execution, and arbitrary file upload flaws in plugins like Hummingbird, JetFormBuilder, Mail Mint, and MemberDash. Most vulnerabilities were patched; 23 remain unpatched. Cross-site scripting and missing authorization were the most common vulnerability types.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)
Matched: WordPress
Wordfence recorded 246 WordPress vulnerabilities across 174 plugins and 5 themes for the week of August 24–30, 2026. Of these, 234 were patched and 12 remain unpatched. Severity breakdown: 18 critical, 73 high, 153 medium, 2 low. Critical issues included unauthenticated remote code execution in Avada and Drag and Drop Multiple File Upload for CF7, authentication bypasses in ManageWP Worker and WPMU DEV Dashboard, and a backdoor in Newspapers X. Firewall rules were immediately deployed for Premium users covering several high-risk flaws.