Filtered by tag: unauthenticated attackers × Clear
100,000 WordPress Sites Affected by Privilege Escalation Vulnerability in Pods WordPress Plugin
Matched: WordPress
A critical unauthenticated privilege escalation vulnerability was found in the Pods WordPress plugin, active on over 100,000 sites. Reported August 10, 2026, the flaw lets attackers gain administrator access without credentials, enabling actions like overwriting any user's password, including the site owner's, leading to full site takeover.
Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability was patched in Elementor Pro, a WordPress plugin with around 6 million active installations. Discovered July 24, 2026, the flaw allows attackers without credentials to upload executable PHP files, potentially enabling remote code execution and complete site takeover. Users should update immediately.