#Plugin Security
All CosmicBytez Labs articles tagged #Plugin Security, across news, security advisories, how-to guides, and projects.
- News
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
CVE-2026-62062 (CVSS 8.8) lets one clicked link create a rogue WordPress admin via Elementor's broken CSRF check on 2M+ sites.
- Security
CVE-2026-82901: Ultra Addons for Contact Form 7 Arbitrary File Upload
Ultra Addons for Contact Form 7 (≤ 3.5.50) allows unauthenticated arbitrary file upload via a weakly validated PDF Generator signature field, enabling RCE.
- News
WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution
WordPress.org now auto-scans every plugin release with AI and Jetpack Scan before distribution, blocking high-risk updates without human review.
- News
Over 3 Million WordPress Sites Exposed by Migration Plugin SQL Injection Flaw
A high-severity SQL injection in All-in-One WP Migration and Backup lets attackers chain trackback abuse into remote code execution.
- News
WordPress Backup Plugin Flaw Exposes Millions of Sites to Takeover Attacks
A second-order SQL injection in All-in-One WP Migration and Backup can leak a secret key and lead to full site takeover; 3.25M sites still exposed.
- Security
CVE-2026-9055: Amelia WordPress Plugin Privilege Escalation Vulnerability
A validation flaw in Amelia's customer-update endpoint lets an attacker become a manager, then hijack an administrator account for full takeover.
- Security
MyHome Core WordPress Plugin: Auth Bypass Enables Admin Takeover (CVE-2026-15980)
CVE-2026-15980 (CVSS 9.8) lets unauthenticated attackers forge activation tokens to hijack WordPress accounts via MyHome Core.
- Security
Uix UserCenter WordPress Plugin: Hardcoded Signing Key Enables Unauthenticated Account Takeover
CVE-2026-16259 (CVSS 9.8) lets attackers hijack any account on sites running Uix UserCenter — no login needed, and no fix exists yet.
- Security
Icollect Data Collection & Publishing Plugin: Hardcoded Secret Enables Unauthenticated Arbitrary File Read
CVE-2026-77012 (CVSS 9.3) lets unauthenticated attackers read server files via a WordPress plugin's default publishing secret.
- Security
CVE-2026-78003: Critical SSRF via Path Traversal in Mailgun for WordPress Plugin
A critical SSRF vulnerability (CVSS 9.8) in Mailgun for WordPress ≤ 2.2.0 lets unauthenticated attackers make server-side requests via path traversal.
- Security
CVE-2026-16576: Dokan WooCommerce Plugin Privilege Escalation to RCE
A missing capability check in the Dokan multivendor WooCommerce plugin allows Shop Managers to install arbitrary plugins, leading to full site compromise.
- Security
CVE-2026-52884: Notepad++ Trusted Directory Bypass via Path Traversal (CVSS 7.8)
A path traversal flaw in Notepad++ v8.9.6.1 allows attackers to bypass the trusted directory plugin verification check using path sequences, potentially...
- News
Critical Everest Forms Pro Flaw Exploited to Take Over WordPress Sites
Hackers are actively exploiting a critical vulnerability (CVE-2026-3300) in the Everest Forms Pro WordPress plugin, enabling them to take complete control of…
- Security
CVE-2026-49777: CVSS 10 Flaw in WooCommerce Product Slider Pro Enables Malware Implantation
A maximum-severity input validation vulnerability in Product Slider Pro for WooCommerce allows attackers to implant malicious software. Affects all versions…
- Security
CVE-2026-7465: RCE in Spectra Gutenberg Blocks WordPress Plugin (CVSS 8.8)
A high-severity remote code execution vulnerability in the Spectra Gutenberg Blocks plugin for WordPress allows authenticated Contributor-level attackers...
- News
Avada Builder WordPress Plugin Flaws Allow Site Credential
Two vulnerabilities in the Avada Builder plugin for WordPress, with an estimated one million active installations, allow hackers to read arbitrary files...
- Security
CVE-2026-6443: WordPress Accordion Plugin Backdoor in Version 1.4.6
The Accordion and Accordion Slider WordPress plugin version 1.4.6 was sold to a malicious threat actor who embedded a persistent backdoor, granting...
- News
File Read Flaw in Smart Slider Plugin Impacts 500K
A vulnerability in the Smart Slider 3 WordPress plugin, active on more than 800,000 websites, allows subscriber-level users to read arbitrary files on the...
- Security
CVE-2026-3629: WordPress User Import Plugin Privilege
The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to 1.29.7, allowing authenticated...