#Patchstack
All CosmicBytez Labs articles tagged #Patchstack, across news, security advisories, how-to guides, and projects.
- News
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
CVE-2026-62062 (CVSS 8.8) lets one clicked link create a rogue WordPress admin via Elementor's broken CSRF check on 2M+ sites.
- News
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Five critical flaws in WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP enable auth bypass, takeover, and RCE.
- News
Critical GiveWP Flaw Lets Hackers Run Server Commands
CVE-2026-82222 chains PHP object injection and an auth-bypass bug in GiveWP, letting attackers run OS commands on 100,000+ WordPress donation sites.
- Security
CVE-2026-32479: Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro
Critical unauthenticated SQL injection (CVSS 9.3) in the WordPress plugin Visitor Traffic Real Time Statistics Pro ≤ 11.17. Patch to 11.18.
- Security
CVE-2026-32566: Unauthenticated Privilege Escalation in ACPT (Pro) Custom Post Types Plugin
Critical unauthenticated privilege escalation (CVSS 9.8) in WordPress plugin ACPT (Pro) ≤ 2.0.63. No official patch yet — Patchstack has a mitigation rule.