#Wordfence
All CosmicBytez Labs articles tagged #Wordfence, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-120531: Subscribe2 WordPress Plugin Unauthenticated Stored XSS
The Subscribe2 plugin for WordPress (≤ 10.47) allows unauthenticated stored XSS via the data[ip] parameter. Update to 10.48 or later where available.
- News
WordPress Core RCE Flaw Draws Nearly 63,000 Attack Attempts in 24 Hours
An unauthenticated RCE race condition in WordPress Core 4.7 through 7.1.3 is under attack within a day of the 7.1.4 patch. Update now.
- Security
CVE-2026-108587: Unauthenticated Arbitrary File Upload in 10Web Booster Leads to RCE
A leaked REST nonce lets unauthenticated attackers upload executable files via 10Web Booster's compressCustom function, enabling full RCE.
- News
Hackers Exploit Critical WooCommerce Wholesale Lead Capture Flaw to Plant PHP Backdoors
Hackers exploit a critical flaw in the WooCommerce Wholesale Lead Capture plugin to upload PHP backdoors; Wordfence has blocked 100,000+ attacks.
- News
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Five critical flaws in WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP enable auth bypass, takeover, and RCE.
- News
Critical Avada WordPress Theme Flaw Enables Zero-Click RCE
Wordfence's AI agent chained six flaws in the Avada theme into an unauthenticated RCE, patched in Avada 7.16.1 for 1M+ sites.
- Security
ARVE WordPress Plugin Backdoor Grants Instant Admin Access to ~20,000 Sites
A supply chain attack introduced a backdoor into ARVE – Advanced Responsive Video Embedder version 10.8.7, enabling any attacker to gain full WordPress...
- Security
CVE-2026-8095: WordPress Frontend File Manager Plugin Allows Arbitrary File Deletion
A high-severity authenticated file deletion vulnerability in the nmedia Frontend File Manager Plugin for WordPress allows subscribers to delete any file...
- Security
CVE-2026-12415: WordPress Invoice Generator Privilege Escalation (CVSS 9.8)
A critical unauthenticated privilege escalation flaw in the WordPress Invoice Generator plugin allows any attacker to take over administrator accounts via...