#WordPress
All CosmicBytez Labs articles tagged #WordPress, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-108587: Unauthenticated Arbitrary File Upload in 10Web Booster Leads to RCE
A leaked REST nonce lets unauthenticated attackers upload executable files via 10Web Booster's compressCustom function, enabling full RCE.
- Security
CVE-2026-104800: Unauthenticated RCE in AGE-GATE WordPress Plugin
A critical 9.8 CVSS flaw lets unauthenticated attackers execute arbitrary code on WordPress sites via AGE-GATE's exposed admin.php endpoint.
- Security
CVE-2026-87855: JTL-Connector for WooCommerce Arbitrary File Upload
Unauthenticated arbitrary file upload in JTL-Connector for WooCommerce (≤ 2.4.3) via saveImage() enables webshell upload and RCE.
- Security
CVE-2026-97657: Abandoned Cart Pro for WooCommerce Authentication Bypass
Malleable AES-CTR encryption and a bypassable HMAC let attackers forge cart-recovery tokens and take over any WooCommerce account.
- Security
CVE-2026-97668: Abandoned Cart Pro for WooCommerce Unauthenticated SQL Injection
Unauthenticated SQL injection in Abandoned Cart Pro's guest-cart meta_value lets attackers read data and escalate to full admin takeover.
- News
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
CVE-2026-85097 (CVSS 10.0), a critical flaw in the Bricksforge WordPress plugin, is under active exploitation enabling unauthenticated RCE.
- Security
CVE-2026-104028: Unrestricted File Upload in Anton Extensions Risks Full Site Takeover
Anton Extensions ≤ 1.2.2 skips capability, nonce, and file-type checks, letting unauthenticated attackers upload PHP shells for RCE.
- Security
CVE-2026-107657: HivePress Directory Plugin Unauthenticated Stored XSS
An unauthenticated stored XSS in HivePress's custom profile attributes lets attackers inject scripts that fire on every visitor to an affected page.
- Security
CVE-2026-103694: Mobile Builder Plugin Lets Any Registered User Become a WordPress Administrator
Mobile builder ≤ 1.4.2 fails to restrict which user meta keys a logged-in user can update via REST, enabling self-promotion to admin.
- Security
CVE-2026-103695: Unauthenticated SQL Injection in Mobile Builder's vendor_id Parameter
Mobile builder ≤ 1.4.2 fails to sanitize the vendor_id parameter, letting unauthenticated attackers run SQL injection attacks.
- Security
CVE-2026-103305: Missing CSRF Checks in Prenotazioni Enable Unauthenticated Stored XSS
Prenotazioni ≤ 1.7.5 saves settings without authorization or CSRF checks and fails to escape output, enabling stored XSS attacks.
- Security
CVE-2026-104398: Critical Object Injection in WooCommerce AFFI Affiliate Marketing Plugin
A deserialization flaw in VillaTheme's AFFI WooCommerce plugin allows unauthenticated PHP object injection, risking full site takeover.
- Security
CVE-2026-14854: Unauthenticated Memory-Exhaustion DoS in WooCommerce Bookings
WooCommerce Bookings before 3.11.0 lets unauthenticated attackers exhaust server memory with a single unbounded AJAX request.
- Security
CVE-2026-103889: Unauthenticated RCE in 3D Product Configurator for WooCommerce
An unauthenticated attacker can POST a malicious xpv_image payload to the WooCommerce 3D Product Configurator plugin for RCE (CVSS 9.8).
- Security
CVE-2026-104732: Advanced IP Blocker 2FA Step-Skip Authentication Bypass
A missing step-1 check in Advanced IP Blocker's 2FA login flow lets attackers brute-force a 6-digit TOTP code and fully bypass authentication (CVSS 9.8).
- Security
CVE-2026-107645: Blocksy Companion Disables Dokan's Nonce Check for Unauthenticated Vendor Takeover
An AJAX handler in Blocksy Companion disables Dokan's nonce check, letting unauthenticated attackers auto-register as a vendor (CVSS 9.1).
- Security
CVE-2026-94589: Extensions For CF7 Unauthenticated Arbitrary File Upload to RCE
An unauthenticated attacker can upload a disguised shell.php through Extensions For CF7's signature field, leading to remote code execution (CVSS 9.8).
- Security
CVE-2026-104747: Unauthenticated PHP Object Injection in the Haaken WordPress Theme
The Haaken WordPress theme (≤ 1.5) allows unauthenticated PHP object injection via insecure deserialization, rated CVSS 8.1.
- News
Ninja Forms and WPC Product Bundles Flaws Exploited to Backdoor WordPress Sites
Attackers are chaining stored XSS bugs in Ninja Forms and WPC Product Bundles for WooCommerce to plant hidden admins and backdoors on 530,000+ sites.
- News
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database and Shared Memory
Sucuri found the SC WordPress backdoor rebuilding itself from eight file, database, and shared-memory locations, using Ethereum RPC gateways for C2.
- Security
CVE-2026-103355: Unlimited Elements For Elementor Blind SQL Injection
A critical, unauthenticated blind SQL injection in the Unlimited Elements For Elementor WordPress plugin (≤ 2.0.20) exposes site databases.
- Security
CVE-2026-92536: ProfilePress WordPress Plugin Exposes User Data via Shortcode Injection
ProfilePress WordPress plugin versions ≤4.17.4 leak user emails, usernames, and registration dates via shortcode injection (CVSS 8.8). Patch to 4.17.5 now.
- Security
CVE-2026-92977: Unauthenticated Stored XSS in Real Cookie Banner WordPress Plugin
Real Cookie Banner ≤5.3.5 lets unauthenticated attackers plant stored XSS via WordPress comments; CVSS 7.2. Patch to 5.3.6+ now.
- Security
CVE-2026-93428: Ultimate Member Plugin Missing Authorization Exposes Private Profile Fields
Ultimate Member ≤2.13.1 has a missing-authorization flaw letting unauthenticated attackers read privacy-restricted profile fields via directory AJAX endpoint.
- Security
CVE-2026-96270: Unauthenticated Stored XSS in Ultimate Member via form_id
Unauthenticated stored XSS in Ultimate Member (≤ 2.13.1) via form_id fires when admins open the Users page in wp-admin. Patched in 2.14.0.
- Security
CVE-2026-97644: Groundhogg Privilege Escalation via Contact Identity Rebinding
CVE-2026-97644 (CVSS 8.8): Groundhogg ≤ 4.9 lets Sales Person+ users rebind contact records to an Admin's user ID, enabling full account takeover.
- Security
Critical Auth Bypass in DevKit Pro Lets Unauthenticated Attackers Take Over WordPress Admin Accounts
Critical CVSS 9.8 auth bypass in DevKit Pro (≤2.3.0) lets unauthenticated attackers forge a cookie and take over any WordPress administrator account.
- Security
Critical Path Traversal in Super Forms WordPress Plugin Exposes wp-config.php
A CVSS 9.1 unauthenticated path traversal flaw in the Super Forms WordPress plugin (≤ 6.3.316) lets attackers read wp-config.php and other sensitive files.
- Security
Critical Auth Bypass in Divi Membership Lets Attackers Log In as Any User
CVE-2026-19660 (CVSS 9.8): a forged paypal_param GET request lets unauthenticated attackers log in as any WordPress user, including admins.
- Security
CVE-2026-92244: Unauthenticated Stored XSS in WooCommerce PDF Invoices Plugin
High-severity stored XSS (CVSS 7.2) in PDF Invoices & Packing Slips for WooCommerce, 300K+ sites, triggered via guest checkout fields.
- Security
CVE-2026-103752: Unauthenticated Admin Takeover in the WordPress Authorizer Plugin
Critical unauthenticated privilege escalation (CVSS 9.8) in WordPress's Authorizer plugin ≤3.15.3 lets attackers become admin via an Azure AD OAuth2 flaw.
- Security
CVE-2026-62071: Unauthenticated SQL Injection in WordPress File Upload Plugin
Critical unauthenticated SQLi (CVSS 9.3) in WordPress File Upload ≤ 5.1.10 lets attackers read or alter site databases. Patched in 5.2.0.
- News
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
CVE-2026-62062 (CVSS 8.8) lets one clicked link create a rogue WordPress admin via Elementor's broken CSRF check on 2M+ sites.
- Security
CVE-2026-77203: WordPress Groups Plugin Privilege Escalation
A flaw in groups_join() lets Subscriber-level WordPress users self-enroll into admin groups, escalating to full Administrator privileges.
- Security
Ad Inserter Plugin Broken Access Control Enables Code Injection (CVE-2026-81655)
Ad Inserter for WordPress lets logged-in users as low as subscriber reach an unrestricted settings page and inject unfiltered code.
- Security
CVE-2026-82901: Ultra Addons for Contact Form 7 Arbitrary File Upload
Ultra Addons for Contact Form 7 (≤ 3.5.50) allows unauthenticated arbitrary file upload via a weakly validated PDF Generator signature field, enabling RCE.
- Security
CVE-2026-85984: miniOrange OTP Login Plugin Authentication Bypass
Unauthenticated attackers can log in as any WordPress admin via a missing password check in miniOrange OTP Login ≤ 5.5.5 (CVSS 9.8).
- Security
Unauthenticated Stored XSS in Download Manager Pro Subscription Form (CVE-2026-86609)
Download Manager Pro fails to sanitize its email-locked subscription form, letting unauthenticated attackers plant stored XSS against admins.
- Security
Malcure Malware Shield Missing Authorization Enables Multisite File Write (CVE-2026-96896)
Malcure Malware Shield lacks an auth check on an AJAX action, letting subsite admins write or delete files network-wide on multisite.
- News
Elementor WordPress Flaw Lets Attackers Create Admin Accounts
A CSRF flaw in Elementor 4.3.0 and 4.3.1 (CVE-2026-62062) bypassed REST nonce checks, letting attackers create rogue WordPress admin accounts.
- Security
CVE-2026-14281: Unauthenticated Admin Takeover in WAWP WooCommerce Plugin
Missing REST permission checks in the WAWP plugin (≤4.8.6) let anyone register as a WordPress administrator via signup. CVSS 9.8, PoC public.
- News
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
A critical WordPress core flaw (CVE-2026-87902, CVSS 9.2) enabling unauthenticated RCE is under active exploitation hours after its Sept 22 patch.
- Security
CVE-2026-12227: Visual Composer Website Builder Unauthenticated Local File Inclusion
An unauthenticated local file inclusion in Visual Composer's vcv-template parameter lets attackers execute arbitrary PHP on WordPress sites.
- Security
CVE-2026-75799: Unauthenticated Arbitrary PHP File Upload in YAHMAN Add-ons for WordPress
Critical CVSS 9.0 flaw in YAHMAN Add-ons (≤0.9.30) lets unauthenticated attackers cache arbitrary PHP files for RCE. Patched in 0.9.31.
- News
Chinese Hackers Exploit WordPress, Zyxel Flaws to Steal Government Data
Chinese-speaking actor breached 996 Zyxel switches and 49 orgs via WordPress flaws, stealing 18,566 government records.
- News
WordPress Patches 'Click2Shell' Vulnerability
WordPress 7.1.1 patches a CSRF flaw that let attackers force theme installs and chain to full remote code execution on self-hosted sites.
- News
WordPress 'Comment2Shell' Flaw Turns a Blog Comment Into Admin RCE
A parsing gap lets one approved comment auto-execute in an admin's browser, chaining to full remote code execution on the server.
- Security
CVE-2026-13355 — Meta Box AIO Unauthenticated Privilege Escalation to Administrator
Chained flaw in Meta Box AIO lets unauthenticated attackers inject a shortcode that grants WordPress Administrator access (CVSS 9.8).
- Security
CVE-2026-19658 — Unauthenticated PHP Object Injection in Give Tributes for WordPress
Give Tributes ≤ 2.3.1 lets unauthenticated attackers inject a PHP object (CVSS 9.8); impact depends on a co-installed POP gadget chain.
- News
Click2Shell PoC Exploit Code Now Public for Patched WordPress CSRF Flaw
Researcher Paulos Yibelo published full technical details and working exploit code for the WordPress Click2Shell CSRF-to-RCE chain.
- Security
CVE-2026-82187: Unauthenticated Arbitrary File Upload in Web to Print Online Designer
A WooCommerce plugin used by print shops fails to validate uploads and leaks its own protection token, enabling unauthenticated RCE.
- Security
CVE-2026-1255: YS LeadGen WordPress Plugin Leaks Captured Lead Data
An unauthenticated AJAX action in the YS LeadGen plugin exposes all captured form submissions, including PII, to anyone who requests it.
- Security
Photo Gallery WordPress Plugin Flaw Allows Arbitrary File Upload
A loop-counter bug in the Photo Gallery, Sliders, Proofing & Themes plugin lets gallery managers bypass archive extension checks and run code.
- Security
SAML Single Sign On Plugin Flaw Enables WordPress Account Takeover
CVE-2026-82842 lets a malicious identity provider assert any login name, letting attackers authenticate as any WordPress user, including admins.
- Security
Unlimited Elements For Elementor Plugin Vulnerable to PHP Object Injection
A missing capability check in an AJAX action lets subscriber-level users trigger PHP object injection in the Unlimited Elements For Elementor plugin.
- Security
Forminator Forms Plugin Flaw Enables Remote Code Execution via XML-RPC
CVE-2026-87067 lets users with forms-management permission write arbitrary files and execute code through insecure XML-RPC deserialization.
- Security
Gravity Forms Unauthenticated File Upload Lets Attackers Achieve RCE
CVE-2026-84434 (CVSS 9.8) lets unauthenticated attackers bypass Gravity Forms' hidden-field validation to upload executable files. Patch now.
- Security
WP Photo Album Plus RCE Lets Subscribers Hijack ImageMagick Commands
CVE-2026-87909 (CVSS 7.5) lets Subscriber-level WordPress users achieve RCE in WP Photo Album Plus via unsanitized filenames passed to ImageMagick.
- Security
WP Recipe Maker Flaw Lets Attackers Run Shortcodes via Recipe Ratings
CVE-2026-89274 (CVSS 9.1) in WP Recipe Maker lets unauthenticated attackers trigger server-side shortcode execution through approved rating comments.
- Security
Forminator Forms Bug Lets Attackers Run Shortcodes via Quiz Parameter
CVE-2026-92229 (CVSS 9.1) in Forminator Forms lets unauthenticated attackers execute arbitrary shortcodes by abusing the quiz current_url parameter.
- News
Brevo Supply Chain Attack Injects Malware Into 100,000 Websites
A stolen Cloudflare API key let attackers hijack Brevo's site and embedded scripts for hours, hitting 100,000+ sites with ClickFix malware.
- News
New WordPress 'Click2Shell' Flaw Forces Theme Installs, Can Chain to Code Execution
A URL-parsing mismatch lets one link silently install a WordPress theme for a logged-in admin, chainable to critical remote code execution.
- Security
Critical RCE in AF Companion WordPress Plugin (CVE-2026-84738)
AF Companion before 2.2.0 lets low-privileged store-management users upload arbitrary PHP files, enabling full remote code execution.
- News
Malicious Admin Menu Editor Pro Plugin Backdoors 1,500 WordPress Sites
Malicious Admin Menu Editor Pro updates backdoored 1,500+ WordPress sites after the developer's site was compromised by an attacker.
- News
Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Two unauthenticated RCE flaws in The Events Calendar WordPress plugin risk takeover of 200,000+ sites; patches are now available.
- Security
Unauthenticated Privilege Escalation in JetFormBuilder ≤ 3.6.2 Allows Admin Account Creation
A critical flaw in JetFormBuilder ≤ 3.6.2 lets unauthenticated attackers register admin accounts via a crafted form-ID request.
- Security
Critical TrueBooker Plugin Flaw Enables Unauthenticated Admin Account Takeover
A CVSS 9.8 authorization bypass in TrueBooker lets unauthenticated attackers change any user's email and reset the password for full takeover.
- News
Hackers Exploit Critical WooCommerce Wholesale Lead Capture Flaw to Plant PHP Backdoors
Hackers exploit a critical flaw in the WooCommerce Wholesale Lead Capture plugin to upload PHP backdoors; Wordfence has blocked 100,000+ attacks.
- News
WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution
WordPress.org now auto-scans every plugin release with AI and Jetpack Scan before distribution, blocking high-risk updates without human review.
- Security
CVE-2026-81648: Unauthenticated Authorization Bypass in CryptoPayment Gateway WordPress Plugin
CVSS 10 flaw in CryptoPayment Gateway (≤ 1.2.2) lets anyone delete files, overwrite config, and steal cleartext wallet keys via an open AJAX endpoint.
- Security
Mass Assignment Flaw in MemberPress Corporate Accounts Enables Admin Takeover
CVE-2026-15451 lets a corporate sub-account holder create rogue WordPress admins or hijack existing ones via unfiltered mass assignment.
- Security
Privilege Escalation in User Registration & Membership ≤ 5.2.7
CVE-2026-80071 lets Author-level WordPress users self-assign an arbitrary membership plan and escalate straight to Administrator.
- Security
CVE-2026-86406: User Registration & Membership Purchase Flaw Lets Any Subscriber Escalate to Administrator
A missing capability check in User Registration & Membership's purchase flow lets any Subscriber claim an Administrator-mapped plan for free.
- Security
CVE-2026-17037: Kirki WordPress Plugin Unauthenticated Stored XSS
Unauthenticated Stored XSS in the Kirki WordPress plugin (≤ 6.2.0) via the comment parameter lets attackers inject persistent scripts. CVSS 7.2.
- Security
Frontegg SAML SSO Plugin Flaw Lets Anyone Log In as WordPress Admin
CVE-2026-75800 lets unauthenticated attackers forge SAML responses and log in as any WordPress user, including administrators.
- Security
Code Monkeys Proposals Plugin Lets Any Subscriber Delete WordPress Files
CVE-2026-77005 allows low-privilege WordPress users to delete arbitrary server files, including wp-config.php, enabling full site takeover.
- Security
WebTotem Backups Plugin Lets Any Subscriber Delete WordPress Files
CVE-2026-77006 lets low-privilege WordPress users delete arbitrary server files after the plugin discards its own CSRF check result.
- Security
CSRF-to-RCE File Upload Flaw in Gpx2Graphics Plugin
CVE-2026-81090 lets attackers trick a logged-in WordPress admin into uploading a PHP webshell through the Gpx2Graphics plugin.
- Security
DS Ad Rotator Plugin Flaw Allows Unauthenticated RCE on WordPress
CVE-2026-81402 lets unauthenticated attackers upload arbitrary PHP files through the DS Ad Rotator plugin's unprotected image upload handler.
- Security
Masteriyo LMS Deserialization Flaw Lets Low-Privilege Users Hit RCE
CVE-2026-82845 lets minimal-account WordPress users inject PHP objects through Masteriyo LMS metadata and achieve remote code execution.
- News
Elementor Pro Flaw Exploited to Hack WordPress Sites, 190K+ Attempts Blocked
A critical arbitrary file upload bug in Elementor Pro (CVE-2026-32475) is under active exploitation, with Defiant blocking 190,000+ attack attempts.
- Security
Critical Unauthenticated Hook Injection in ComboBlocks WordPress Plugin
ComboBlocks (Post Grid and Gutenberg Blocks) versions 2.2.32-2.3.1 let unauthenticated attackers inject dynamic action hooks, risking full RCE.
- Security
Critical Auth Bypass in Frontend Admin Plugin Enables Full Account Takeover
A critical flaw in the Frontend Admin by DynamiApps WordPress plugin lets unauthenticated attackers hijack any account, including admins.
- Security
CVE-2026-16310: MemberDash WordPress Plugin Unauthenticated Account Takeover
MemberDash ≤ 1.8.5 has an IDOR letting unauthenticated attackers change any WordPress user's password via a crafted registration request.
- News
5,400+ Hacked Sites Serve ClickFix Payloads Stored on the Blockchain
Attackers stash ClickFix malware stagers in BNB Smart Chain smart contracts, giving compromised WordPress and PrestaShop sites takedown-resistant C2.
- Security
MStore API Plugin: Unauthenticated JWT Forgery Auth Bypass
Missing signature verification in MStore API's Firebase phone-auth handler lets attackers forge JWTs and impersonate any WordPress account.
- Security
AI Website Builder WordPress Plugin: Unauthenticated RCE via Missing Authorization
CVE-2026-82923 lets unauthenticated attackers write arbitrary files, install plugins, and wipe content on sites running the GitHub build of AI Website Builder.
- Security
Critical Unauthenticated RCE in Hummingbird WordPress Plugin
A namespace-resolution bug leaves Hummingbird's debug log web-accessible and unsanitized, letting unauthenticated attackers plant PHP via a cookie.
- Security
Critical LFI in Divi Ajax Filter Plugin Allows Unauthenticated PHP Execution
CVE-2026-11613 lets unauthenticated attackers include and execute arbitrary PHP files in the Divi Ajax Filter WordPress plugin (≤ 5.1.2).
- News
Over 3 Million WordPress Sites Exposed by Migration Plugin SQL Injection Flaw
A high-severity SQL injection in All-in-One WP Migration and Backup lets attackers chain trackback abuse into remote code execution.
- Security
Unauthenticated Privilege Escalation in Authorizer ≤ 3.15.1
CVE-2026-81294 (CVSS 9.8) lets unauthenticated attackers gain elevated privileges in the Authorizer WordPress login/SSO plugin.
- Security
CVE-2025-9314: Unauthenticated File Upload in Developer Tools WordPress Plugin
A critical, unauthenticated arbitrary file upload flaw in the Developer Tools plugin's bundled SWFUpload component allows full site takeover.
- Security
CVE-2026-4357: Maximum-Severity File Upload Flaw in Embed HTML5 Game Plugin
A perfect-10 CVSS unauthenticated file upload bug in the Embed HTML5 Game WordPress plugin lets attackers drop PHP backdoors with zero access.
- Security
CVE-2026-77009: Subscriber-to-RCE via Exposed Debug Console in WatchMan-Site7
A critical code injection flaw in WatchMan-Site7 lets any authenticated subscriber run arbitrary PHP through the plugin's unrestricted debug console.
- Security
Unauthenticated SQL Injection in WCFM Marketplace ≤ 3.8.1
A critical unauthenticated SQL injection (CVSS 9.3) in the WCFM Marketplace WordPress plugin exposes vendor and customer database records.
- News
WordPress Backup Plugin Flaw Exposes Millions of Sites to Takeover Attacks
A second-order SQL injection in All-in-One WP Migration and Backup can leak a secret key and lead to full site takeover; 3.25M sites still exposed.
- Security
CVE-2026-18550: Nokri WordPress Theme Unauthenticated Account Takeover
A critical unauthenticated account-takeover flaw in the Nokri WordPress job board theme lets attackers reset any user's password, including admins.
- Security
CVE-2026-9055: Amelia WordPress Plugin Privilege Escalation Vulnerability
A validation flaw in Amelia's customer-update endpoint lets an attacker become a manager, then hijack an administrator account for full takeover.
- Security
CVE-2026-75865: WPLP Cookie Consent Plugin Unauthenticated File Upload
A critical flaw in the WPLP Cookie Consent WordPress plugin lets unauthenticated attackers upload arbitrary files, opening a path to remote code execution.
- Security
Sigma Forms Pro WordPress Plugin: Unauthenticated RCE via File Upload (CVE-2026-14494)
CVE-2026-14494 (CVSS 9.8) lets unauthenticated attackers upload PHP webshells through Sigma Forms Pro's default form templates. No patch yet.
- Security
Unauthenticated Privilege Escalation to Admin in WooCommerce Plugin (CVE-2026-15369)
CVE-2026-15369 (CVSS 9.8) lets unauthenticated attackers self-assign the Administrator role during WooCommerce checkout in Addify's plugin.
- Security
MyHome Core WordPress Plugin: Auth Bypass Enables Admin Takeover (CVE-2026-15980)
CVE-2026-15980 (CVSS 9.8) lets unauthenticated attackers forge activation tokens to hijack WordPress accounts via MyHome Core.
- News
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Five critical flaws in WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP enable auth bypass, takeover, and RCE.
- News
Critical GiveWP Flaw Lets Hackers Run Server Commands
CVE-2026-82222 chains PHP object injection and an auth-bypass bug in GiveWP, letting attackers run OS commands on 100,000+ WordPress donation sites.
- Security
Uix UserCenter WordPress Plugin: Hardcoded Signing Key Enables Unauthenticated Account Takeover
CVE-2026-16259 (CVSS 9.8) lets attackers hijack any account on sites running Uix UserCenter — no login needed, and no fix exists yet.
- Security
Total Processing Card Payments for WooCommerce: Unauthenticated SSRF Enables Payment Verification Forgery
CVE-2026-16947 (CVSS 9.1) lets attackers redirect payment verification requests and forge success responses on WooCommerce stores.
- Security
Icollect Data Collection & Publishing Plugin: Hardcoded Secret Enables Unauthenticated Arbitrary File Read
CVE-2026-77012 (CVSS 9.3) lets unauthenticated attackers read server files via a WordPress plugin's default publishing secret.
- Security
CVE-2026-32479: Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro
Critical unauthenticated SQL injection (CVSS 9.3) in the WordPress plugin Visitor Traffic Real Time Statistics Pro ≤ 11.17. Patch to 11.18.
- Security
CVE-2026-32566: Unauthenticated Privilege Escalation in ACPT (Pro) Custom Post Types Plugin
Critical unauthenticated privilege escalation (CVSS 9.8) in WordPress plugin ACPT (Pro) ≤ 2.0.63. No official patch yet — Patchstack has a mitigation rule.
- News
Critical Avada WordPress Theme Flaw Enables Zero-Click RCE
Wordfence's AI agent chained six flaws in the Avada theme into an unauthenticated RCE, patched in Avada 7.16.1 for 1M+ sites.
- Security
Critical TranslatePress Flaw Exposes 400,000+ WordPress Sites to Account Takeover
CVE-2026-19632 leaks a plaintext admin password-reset key via an unauthenticated AJAX action in TranslatePress, enabling full site takeover.
- Security
WordPress Jawn Theme Unauthenticated Privilege Escalation
CVE-2026-78477 allows unauthenticated attackers to escalate to WordPress administrator in Jawn theme versions up to 1.4.2, CVSS 9.8 critical.
- Security
CVE-2026-0551: PHP Object Injection in PPWP – Password Protect Pages WordPress Plugin
PPWP WordPress plugin up to 1.9.18 allows contributor-level PHP object injection via deserialization, enabling RCE on affected sites.
- Security
CVE-2026-16149: Security Hardener WordPress Plugin Bypasses All REST API Authorization
Security Hardener plugin up to 2.4.4 overwrites REST endpoint permissions via rest_endpoints filter, bypassing all registered auth callbacks.
- Security
CVE-2026-78003: Critical SSRF via Path Traversal in Mailgun for WordPress Plugin
A critical SSRF vulnerability (CVSS 9.8) in Mailgun for WordPress ≤ 2.2.0 lets unauthenticated attackers make server-side requests via path traversal.
- Security
CVE-2026-16576: Dokan WooCommerce Plugin Privilege Escalation to RCE
A missing capability check in the Dokan multivendor WooCommerce plugin allows Shop Managers to install arbitrary plugins, leading to full site compromise.
- News
Critical Elementor Pro Bug Exposes WordPress Sites to RCE Attacks
CVE-2026-32475 (CVSS 9.0): Unauthenticated attackers can upload PHP webshells via a loop desync flaw in Elementor Pro's file upload field.
- Security
Critical Unauthenticated RCE in JetEngine WordPress Plugin (CVE-2026-66613)
A CVSS 9.8 unauthenticated remote code execution flaw in JetEngine plugin <= 3.8.14 lets attackers fully compromise WordPress sites.
- Security
Critical SQL Injection in Maps Marker Pro WordPress Plugin (CVE-2026-73183)
An unauthenticated SQL injection flaw (CVSS 9.3) in Maps Marker Pro <= 4.32 exposes WordPress databases to full read and write access.
- Security
CVE-2026-75860: WordPress JSON Options Plugin Unauthenticated Options Update (CVSS 9.8)
Critical WordPress plugin flaw lets unauthenticated attackers update arbitrary options, enabling privilege escalation and full site takeover.
- Security
Critical PHP Object Injection in FundEngine Plugin (CVE-2026-32470)
An unauthenticated PHP Object Injection flaw (CVSS 9.8) in FundEngine <= 1.7.9 allows remote attackers to execute arbitrary code without credentials.
- Security
Critical File Upload RCE in Templatiq WordPress Plugin (CVE-2026-32474)
CVE-2026-32474 allows Contributor-level users to upload arbitrary files in Templatiq <= 0.2.5, enabling remote code execution. CVSS score: 9.9.
- News
Forminator WordPress Plugin Flaw Enables Unauthenticated RCE via PHP Upload
CVE-2026-15748 (CVSS 9.8) in Forminator Forms allows unauthenticated PHP webshell uploads for full RCE on 600,000+ WordPress sites. Patch to 1.56.2 now.
- Security
WordPress ARForms Plugin Critical PHP Object Injection — CVE-2024-13784
A critical unauthenticated PHP object injection flaw in the ARForms WordPress plugin (CVSS 9.8) allows arbitrary code execution via deserialization.
- Security
CVE-2026-14498: Query Wrangler WordPress Plugin Exposes Sites to RCE
A high-severity RCE flaw (CVSS 8.8) in the Query Wrangler WordPress plugin lets authenticated attackers inject and execute arbitrary PHP via a missing...
- Security
CVE-2026-14524: Critical Unauthenticated File Deletion in ProSolution WP Client
A CVSS 9.1 flaw in ProSolution WP Client lets unauthenticated attackers delete arbitrary files on WordPress servers, potentially wiping installations.
- Security
CVE-2026-15002: Stored XSS in Autopay WooCommerce Plugin for WordPress
CVE-2026-15002 is a stored XSS flaw (CVSS 7.2) in the Autopay WooCommerce plugin, letting attackers inject persistent scripts via the CSS editor POST parameter.
- Security
CVE-2026-15142: Real Estate Manager Pro Privilege Escalation via Capability Confusion
CVSS 7.5 flaw in Real Estate Manager Pro for WordPress lets attackers escalate privileges by exploiting an attachment ID and user ID confusion bug.
- Security
CVE-2026-16142: TrueBooker WordPress Plugin Unauthenticated Account Takeover
A CVSS 9.8 flaw in TrueBooker for WordPress allows unauthenticated attackers to take over any user account via a vulnerable AJAX handler.
- Security
CVE-2026-18438: Templately WordPress Plugin RCE via File Upload
CVSS 8.8 flaw in Templately for WordPress lets authenticated subscribers execute arbitrary code via a filename validation bypass in file upload.
- Security
CVE-2026-18855: WordPress Link Library Plugin Arbitrary File Deletion
Critical CVSS 9.1 flaw in WordPress Link Library plugin allows unauthenticated attackers to delete arbitrary server files, risking full site takeover.
- Security
CVE-2026-19598: WordPress Pods Plugin Privilege Escalation via Authorization Bypass
CVSS 9.8 flaw in WordPress Pods plugin lets unauthenticated users escalate privileges via a flawed AJAX authorization router in versions up to 3.3.9.
- Security
CVE-2026-14484: WordPress RapiSafe Plugin Arbitrary File Deletion
Critical unauthenticated arbitrary file deletion in WordPress RapiSafe plugin v1.0.4 and below allows attackers to delete any file on the server.
- Security
CVE-2026-15162: WordPress Object Sync for Salesforce — SQLi via REST API
High-severity unauthenticated SQL injection in Object Sync for Salesforce plugin allows attackers to extract data via a misconfigured REST API push endpoint.
- Security
CVE-2026-15303: WordPress 6Storage Rentals Authentication Bypass
Critical authentication bypass in 6Storage Rentals WordPress plugin v2.27.0 allows unauthenticated users to create privileged accounts via exposed AJAX handler.
- Security
CVE-2026-15341: WordPress User Session Synchronizer — Account Takeover
Critical auth bypass in User Session Synchronizer plugin v1.4.0 lets unauthenticated attackers hijack any WordPress account via session sync on every request.
- Security
CVE-2026-12949: Critical Account Takeover in WordPress Wishlist Member Plugin
Critical CVSS 9.8 flaw in WordPress Wishlist Member plugin allows unauthenticated account takeover in versions up to 3.34.1.
- Security
CVE-2026-15413: WordPress 'Link Factory' Plugin Is an Intentional Backdoor (CVSS 10.0)
The Link Factory WordPress plugin is a supply-chain backdoor. Operator-controlled REST API lets attackers run arbitrary commands. Remove it immediately.
- Security
CVE-2026-28154: Reflected XSS in WooCommerce WordPress Themes
High-severity reflected XSS in Samex and M.Anh WooCommerce themes allows attackers to inject malicious scripts via crafted URLs.
- Security
CVE-2026-14182: WooCommerce Email Verification Bypass Allows Account Takeover
A CVSS 9.8 type juggling flaw in Customer Email Verification for WooCommerce lets unauthenticated attackers take over any customer account.
- Security
CVE-2026-18961: WordPress VentraConnect Plugin Authentication Bypass
High-severity auth bypass in the VentraConnect Social Login plugin allows unauthenticated attackers to take over any WordPress account.
- News
BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins
Cybersecurity researchers have uncovered a supply chain compromise targeting WordPress plugin vendor BdThemes, where attackers poisoned JSON configuration...
- Security
CVE-2026-14206: HT Contact Form WordPress Plugin Exposes Visitor PII to Unauthenticated Attackers
The HT Contact Form plugin before 2.9.3 allows any unauthenticated user to read saved form drafts containing visitor names, emails, and physical addresses...
- Security
CVE-2026-14205: WP Events Manager Plugin Allows Fraudulent Paid Event Bookings via Payment Bypass
A critical improper authentication vulnerability in WP Events Manager for WordPress allows unauthenticated attackers to register for paid events without...
- Security
CVE-2026-14364: TrueBooker WordPress Plugin Account Takeover via Password Reset Bypass
A critical unauthenticated account takeover vulnerability in the TrueBooker Appointment Booking plugin for WordPress allows attackers to reset any user's...
- Security
CVE-2026-14365: TrueBooker WordPress Plugin Authorization Bypass Enables Unauthenticated Password Change
A second critical flaw in the TrueBooker Appointment Booking WordPress plugin allows unauthenticated attackers to change the password of any user,...
- Security
ARVE WordPress Plugin Backdoor Grants Instant Admin Access to ~20,000 Sites
A supply chain attack introduced a backdoor into ARVE – Advanced Responsive Video Embedder version 10.8.7, enabling any attacker to gain full WordPress...
- Security
CVE-2026-28005: Critical Privilege Escalation in Kadence WooCommerce Email Designer
A critical unauthenticated privilege escalation flaw (CVSS 9.8) in Kadence WooCommerce Email Designer <= 1.5.19 allows attackers to gain admin access with...
- Security
CVE-2026-28139: Critical PHP Object Injection in Ajax Search Lite
A CVSS 9.8 unauthenticated PHP object injection flaw in Ajax Search Lite <= 4.14.4 exposes 80,000+ WordPress sites to potential remote code execution via...
- Security
CVE-2026-12713: Critical SQL Injection in WPCargo Track & Trace Plugin
An unauthenticated SQL injection vulnerability (CVSS 9.1) in the WPCargo Track & Trace WordPress plugin before version 8.0.4 allows attackers to read and...
- Security
CVE-2026-13339: CubeWP Framework WordPress Plugin Directory Traversal (CVSS 7.5)
A high-severity directory traversal vulnerability in the CubeWP Framework plugin for WordPress allows unauthenticated attackers to read arbitrary files on...
- Security
CVE-2026-15964: WordPress SSO Plugin Critical Authentication Bypass
The Single Sign On For TNG plugin for WordPress contains a critical authentication bypass (CVSS 9.8) allowing unauthenticated attackers to reset any...
- Security
CVE-2026-16144: Kali Forms WordPress Plugin Remote Code Execution
The Kali Forms Contact Form & Drag-and-Drop Builder plugin for WordPress is vulnerable to Remote Code Execution (CVSS 8.1) in all versions up to 2.4.20....
- Security
CVE-2026-18352: WordPress User Access Manager Directory Traversal
The User Access Manager plugin for WordPress (up to v2.3.15) is vulnerable to unauthenticated directory traversal via the 'uamgetfile' parameter, allowing...
- Security
CVE-2026-8457: WooCommerce Social Login Authentication Bypass (CVSS 9.8)
A critical authentication bypass vulnerability in the WooCommerce - Social Login WordPress plugin allows unauthenticated attackers to log in as any...
- Security
CVE-2026-15414: WooCommerce Subscriptions Plugin Privilege Escalation (CVSS 8.8)
A high-severity privilege escalation vulnerability in the Subscriptions for WooCommerce plugin allows authenticated users to elevate their role to...
- Security
CVE-2026-3141: WordPress FormGent Plugin Unauthorized File Deletion (CVSS 9.1)
A critical unauthenticated file deletion vulnerability in the FormGent WordPress plugin allows attackers to delete arbitrary files without authentication,...
- Security
CVE-2026-15397: Missing Authorization in Subscriptions for WooCommerce Plugin
A missing authorization vulnerability in the Subscriptions for WooCommerce plugin allows authenticated users with minimal privileges to perform...
- Security
CVE-2025-10656: WooCommerce Plugin Missing Authorization Allows Unauthenticated Admin Account Creation
A critical missing authorization vulnerability in the Spreadsheet Price Changer for WooCommerce plugin allows unauthenticated attackers to create admin...
- Security
CVE-2026-16610: Critical RCE in WordPress Admin & Site Enhancements Pro Plugin
A CVSS 9.8 unauthenticated remote code execution vulnerability in the Admin and Site Enhancements (ASE) Pro WordPress plugin allows attackers to execute...
- Security
CVE-2026-13423: Streamit WordPress Theme Allows Unauthenticated Arbitrary PHP Function Execution
The Streamit WordPress theme through version 4.5.0 exposes an unauthenticated AJAX route with no authorization or nonce verification, letting any...
- Security
CVE-2026-14545: TrueBooker WordPress Plugin Lets Anyone Take Over Admin Accounts
An unauthenticated password reset flaw in TrueBooker (before v1.2.4) lets any attacker set an arbitrary password on any WordPress account — including...
- Security
CVE-2026-59527: Critical SQL Injection in MapSVG WordPress Plugin
A CVSS 9.3-rated unauthenticated SQL injection vulnerability in the MapSVG WordPress plugin (versions up to 8.14.0) allows remote attackers to read and...
- News
'WP2Shell' Opens Millions of WordPress Sites to Remote Takeover
Attackers are actively chaining CVE-2026-60137 and CVE-2026-63030 just three days after disclosure, targeting one of the largest attack surfaces on the...
- Security
CVE-2026-12394: MemberGlut Plugin Lets Anyone Register as WordPress Admin
A critical privilege escalation flaw in the MemberGlut WordPress plugin allows unauthenticated users to register with any role — including administrator —...
- Security
CVE-2026-13332: Masteriyo LMS Allows Unauthenticated Force-Logout of Any User
A critical unauthenticated AJAX vulnerability in the Masteriyo LMS WordPress plugin allows attackers to terminate any user's session — including...
- Security
CVE-2026-13597: WeChat QR Login WordPress Plugin Authentication Bypass
A critical authentication bypass in the WeChat QR login WordPress plugin allows unauthenticated attackers to forge login events for any account — the...
- Security
CVE-2026-13714: Realtyna IDX Plugin Unauthenticated File Upload via Hardcoded Credentials
A critical CVSS 9.8 unauthenticated arbitrary file upload vulnerability in the Realtyna Organic IDX + WPL Real Estate WordPress plugin (before v5.3.0)...
- Security
CVE-2026-14289: FacturaONE WooCommerce Plugin Allows Unauthenticated File Write
A critical unauthenticated arbitrary file write vulnerability in the FacturaONE para WooCommerce con VeriFactu plugin (before v5.37) allows attackers to...
- Security
CVE-2026-15962: PHP Object Injection in Fluent Forms Pro (CVSS 8.8)
A high-severity PHP Object Injection vulnerability in the Fluent Forms Pro Add On Pack plugin for WordPress allows authenticated attackers with...
- Security
CVE-2026-10818: WPForms Pro Arbitrary File Upload — Unauthenticated RCE
A high-severity vulnerability in WPForms Pro allows unauthenticated attackers to upload malicious files and achieve remote code execution. File type...
- Security
CVE-2026-12877: Critical SQL Injection in WordPress Project Management Plugin
An unauthenticated SQL injection flaw with a CVSS score of 9.1 affects the Project Management, Bug and Issue Tracking Plugin for WordPress before version...
- Security
GoDAM WordPress Plugin Arbitrary File Upload — CVE-2026-14282
A critical unauthenticated arbitrary file upload vulnerability in the GoDAM WordPress media library plugin allows attackers to upload malicious files and...
- Security
WordPress Helpdesk Plugin Unauthenticated Code Injection — CVE-2026-15011
A critical unauthenticated PHP code injection vulnerability in the Customer Support Ticket System & Helpdesk WordPress plugin allows attackers to execute...
- Security
CVE-2026-15981: WordPress SAML SSO Authentication Bypass (CVSS 9.8)
A critical authentication bypass in the WordPress SAML Single Sign On plugin allows unauthenticated attackers to log in as any user, including...
- Security
CVE-2026-14291: WordPress Security Ninja Premium 2FA Authentication Bypass
The Security Ninja Premium WordPress plugin before version 5.290 contains a critical authentication flaw that allows attackers to bypass two-factor...
- Security
CVE-2026-65048: Ninja Forms Unauthenticated Stored XSS via Repeatable Fieldset
A CVSS 9.3 critical stored XSS vulnerability in the Ninja Forms WordPress plugin affects versions 3.10.4 through 3.14.9. The flaw requires no...
- Security
CVE-2026-65049: Ninja Forms Multisite Flaw Enables Network-Wide Data Deletion
A CVSS 9.3 critical incorrect authorization vulnerability in Ninja Forms 3.14.8 and prior for WordPress Multisite allows a subsite administrator to...
- News
WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning
Attackers are exploiting two chained critical WordPress vulnerabilities that enable unauthenticated remote code execution. A public exploit has triggered...
- Security
CVE-2026-13439: WordPress Easy Form Builder Unauthenticated Privilege Escalation (CVSS 9.8)
A critical unauthenticated privilege escalation vulnerability in the Easy Form Builder by WhiteStudio WordPress plugin allows attackers to reset admin...
- News
Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0-Day and More
A single request shouldn't be able to do this much. This week delivered pre-authenticated WordPress RCE, dual SonicWall zero-days exploited since June, a...
- Security
CVE-2026-10081: Unlimited Elements for Elementor Stored XSS via Google Reviews
A stored cross-site scripting vulnerability in the Unlimited Elements for Elementor WordPress plugin (before 2.0.11) allows unauthenticated attackers to...
- Security
CVE-2026-13147: Kirki WordPress Plugin SSRF Allows Unauthenticated Internal Network Scanning
A server-side request forgery vulnerability in the Kirki Customizer Framework WordPress plugin before 6.0.12 allows unauthenticated attackers to make the...
- News
WordPress Core "wp2shell" RCE Flaws Get Public Exploits — Patch Now
Public exploits have been released for the critical wp2shell remote code execution vulnerabilities in WordPress Core, putting millions of sites at...
- News
New wp2shell WordPress Core Flaw Lets Unauthenticated Attackers Run Code
A critical unauthenticated remote code execution vulnerability in WordPress core affects all 6.9 and 7.0 installations. WordPress force-pushed emergency...
- Security
CVE-2026-15103: WPFunnels Plugin Privilege Escalation via Unauthenticated REST Endpoint
A high-severity privilege escalation flaw in WPFunnels for WordPress allows attackers to update arbitrary site options via an unvalidated REST callback,...
- Security
CVE-2026-15982: WordPress Aimogen Pro Plugin Privilege Escalation (CVSS 9.8)
Critical privilege escalation in the Aimogen Pro WordPress plugin (all versions up to 2.8.4) — missing capability check on AI function allows any...
- Security
CVE-2026-12492: WooCommerce OTP Login Plugin Auth Bypass — Full Admin Takeover
The Happy Coders OTP Login for WooCommerce plugin before 2.8 allows unauthenticated attackers to bypass OTP verification and log in as any WordPress user,...
- Security
CVE-2026-15013: WordPress SAML SSO Plugin — Algorithm Confusion Auth Bypass
The miniOrange SAML Single Sign On plugin for WordPress through version 5.4.3 allows unauthenticated attackers to log in as any user via an RSA-to-HMAC...
- News
We Built a Vulnerability Vending Machine: AI Tokens In, Zero-Days Out
Security firm Intruder built an AI-powered system that combines code slicing with large language models to automatically discover complex software...
- Security
CVE-2026-11964: WordPress User Registration Plugin PayPal Webhook Bypass
The User Registration & Membership WordPress plugin before 5.2.2 fails to verify PayPal webhook signatures, allowing unauthenticated attackers to forge...
- News
Australia Warns of Global Campaign Targeting Vulnerable CMS Platforms
The Australian Cyber Security Centre has issued an alert about a coordinated global campaign actively exploiting unpatched vulnerabilities in WordPress,...
- Security
CVE-2026-12761: miniOrange WordPress Social Login Auth Bypass Enables Full Admin Takeover
A critical authentication bypass chain in the miniOrange Social Login and Register WordPress plugin allows unauthenticated attackers to crack a trivially...
- Security
CVE-2026-13353: WordPress WP Ultimate CSV Importer RCE via MappedFields Parameter
A critical CVSS 8.8 remote code execution vulnerability in WP Ultimate CSV Importer allows unauthenticated attackers to execute arbitrary PHP code on...
- News
Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites
An unprotected 800MB server left open for three weeks exposed the full toolkit of a webshell access brokerage operation targeting 1.4 million domains....
- Security
CVE-2026-14894: WordPress Super Forms Plugin Critical Arbitrary File Upload
A critical unauthenticated arbitrary file upload vulnerability in the Super Forms plugin for WordPress (CVSS 9.8) allows attackers to upload and execute...
- Security
CVE-2026-15158: WordPress Blocksy Companion Arbitrary File Upload (CVSS 9.8)
A critical arbitrary file upload vulnerability in the Blocksy Companion WordPress plugin (versions up to 2.1.46) allows unauthenticated attackers to...
- Security
CVE-2026-15282: WordPress Instant Appointment Plugin Critical File Upload
A critical unauthenticated arbitrary file upload flaw (CVSS 9.8) in the Instant Appointment WordPress plugin allows attackers to upload and execute...
- Security
CVE-2026-12153: WP Learn Manager Plugin — Unauthenticated Authorization Bypass Allows Plugin Installation
A critical CVSS 9.8 authorization bypass in the WP Learn Manager WordPress plugin allows unauthenticated attackers to install and activate arbitrary...
- Security
CVE-2026-14487: WordPress Simple Coherent Form Plugin — Critical Unauthenticated File Deletion
A critical CVSS 9.1 vulnerability in the Simple Coherent Form WordPress plugin allows unauthenticated attackers to delete arbitrary files on the server,...
- Security
CVE-2026-9701: WordPress Eventer Plugin — Insecure Password Reset Enables Account Takeover
A critical CVSS 9.8 vulnerability in the Eventer WordPress plugin exposes plaintext password reset keys in user meta, allowing unauthenticated attackers...
- Security
CVE-2024-6228: WordPress WANotifier Plugin Local File Inclusion
A local file inclusion vulnerability in the WANotifier WordPress plugin (before v2.6) allows any authenticated subscriber-level user to include and...
- Security
CVE-2026-4321: Critical SQL Injection in Raera Destekz Plugin (No Patch Available)
A CVSS 9.8 critical SQL injection in the Destekz plugin by Raera - Ankara Web Design allows unauthenticated remote attackers full database access. The...
- Security
CVE-2026-9725: Critical WordPress WooCommerce Plugin File Deletion
A CVSS 9.1 critical unauthenticated arbitrary file deletion vulnerability in the Printcart Web to Print Product Designer for WooCommerce plugin affects...
- Security
CVE-2026-12923: YouTube Showcase WordPress Plugin Arbitrary Function Call
A high-severity arbitrary function call vulnerability in the YouTube Showcase plugin allows authenticated attackers to invoke arbitrary PHP functions via...
- Security
CVE-2026-9711: Critical SQL Injection in EventON WordPress Plugin (CVSS 9.8)
A critical unauthenticated SQL injection vulnerability in the EventON WordPress Virtual Event Calendar Plugin affects versions up to 5.0.11, exposing...
- Security
CVE-2026-12073: ProfileGrid WordPress Plugin Critical Privilege Escalation
A critical CVSS 9.8 vulnerability in the ProfileGrid WordPress plugin allows unauthenticated attackers to take over any user account and escalate...
- Security
CVE-2026-57331: Critical Arbitrary File Deletion in Paid Videochat Turnkey Site
A CVSS 9.9 critical vulnerability in the Paid Videochat Turnkey Site WordPress plugin allows authenticated performer-role users to delete arbitrary files...
- Security
CVE-2026-8095: WordPress Frontend File Manager Plugin Allows Arbitrary File Deletion
A high-severity authenticated file deletion vulnerability in the nmedia Frontend File Manager Plugin for WordPress allows subscribers to delete any file...
- Security
CVE-2026-12415: WordPress Invoice Generator Privilege Escalation (CVSS 9.8)
A critical unauthenticated privilege escalation flaw in the WordPress Invoice Generator plugin allows any attacker to take over administrator accounts via...
- Security
CVE-2026-54820: Critical SQL Injection in JetBooking WordPress Plugin
A critical unauthenticated SQL injection vulnerability (CVSS 9.3) in the JetBooking WordPress plugin affects all versions up to 4.0.4.1, potentially...
- Newsletter
June 23 Digest: FortiBleed, Klue/Salesforce Supply Chain, Squidbleed, GitHub Actions Fix
A Russian IAB harvests 110M credentials from FortiGate firewalls; the Icarus group drains hundreds of Salesforce orgs via Klue OAuth tokens; a 29-year-old...
- News
ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack, with attackers injecting backdoor code into Pro plugin releases...
- News
Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys
Active exploitation of CVE-2026-4020 in the Gravity SMTP WordPress plugin has generated over 17 million malicious requests, allowing unauthenticated...
- News
15,000 WordPress Websites Cleaned Up in SocGholish Botnet Takedown
In a major Operation Endgame action, law enforcement and private partners seized 106 SocGholish command-and-control servers and domains, with...
- News
Operation Endgame Disrupts SocGholish Servers, Cleans 14,971 WordPress Sites
A joint law enforcement operation led by Dutch authorities and including partners from Canada, Germany, and the US has disrupted SocGholish malware...
- Security
CVE-2026-7515: BetterDocs Pro WordPress Plugin — Unauthenticated Local File Inclusion
A critical Local File Inclusion vulnerability in the BetterDocs Pro WordPress plugin (up to v3.8.0) allows unauthenticated attackers to include and...
- News
Police Cleans Nearly 15,000 SocGholish-Infected Sites Tied to Evil Corp
International law enforcement cleaned nearly 15,000 malware-infected WordPress websites and took down more than 100 servers linked to the SocGholish...
- News
ShapedPlugin Update Flow Hacked to Infect WordPress Sites
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack that distributed infected releases to paying customers via the...
- Security
CVE-2026-49772: The Events Calendar Blind SQL Injection (CVSS 9.3)
A critical blind SQL injection vulnerability in The Events Calendar WordPress plugin by StellarWP affects versions 6.15.12 through 6.16.2, allowing...
- Security
CVE-2026-49774: RD Station WordPress Plugin Remote Code Injection (CVSS 9.9)
A critical code injection vulnerability in the RD Station WordPress plugin allows unauthenticated remote code execution through Remote File Inclusion,...
- Security
CVE-2026-52715: GEO my WordPress Unauthenticated SQL Injection (CVSS 9.3)
A critical unauthenticated SQL injection vulnerability in GEO my WordPress versions 4.5.5 and earlier allows attackers to extract database contents...
- Newsletter
June 17 Digest: Teams C2 Evasion, Copilot Data Theft, iRhythm Breach, cPanel KEV
DragonForce hides C2 inside Microsoft Teams relay traffic; a SearchLeak attack weaponizes M365 Copilot for one-click data exfiltration; iRhythm confirms...
- News
'Lorem Ipsum' Malware Pivots to ClickFix Delivery via WordPress
New analysis reveals the 'Lorem Ipsum' malware campaign has adopted ClickFix social engineering as its primary delivery mechanism, leveraging compromised...
- Security
CVE-2016-20066: WordPress CP Polls Persistent XSS via File Upload
WordPress CP Polls plugin version 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through...
- Security
CVE-2026-27053: Critical PHP Object Injection in Broadcast Live Video Plugin
A critical unauthenticated PHP Object Injection vulnerability in the Broadcast Live Video WordPress plugin (versions < 7.1.3) carries a CVSS score of 9.8...
- Security
CVE-2026-39574: Critical SQL Injection in InPost Gallery WordPress Plugin
A critical unauthenticated SQL injection vulnerability (CVSS 9.3) in the InPost Gallery WordPress plugin allows attackers to extract sensitive database...
- Security
CVE-2026-6933: Unauthenticated RCE in Premmerce Dev Tools WordPress Plugin
A high-severity unauthenticated remote code execution vulnerability (CVSS 8.8) in Premmerce Dev Tools for WordPress allows attackers to execute arbitrary...
- Security
CVE-2026-8935: WP Maps Pro Unauthenticated Admin Account Creation (CVSS 9.8)
A critical unauthenticated vulnerability in the WP Maps Pro WordPress plugin before 6.1.1 allows any visitor to create an administrator account and...
- Security
CVE-2026-5513: Bookly WordPress Plugin Stored XSS via Cookie
The Bookly scheduling plugin for WordPress contains a stored cross-site scripting vulnerability in versions up to 27.2, allowing unauthenticated attackers...
- Security
CVE-2026-47365: WordPress Toolkit Argument Injection in cPanel & WHM
A critical CVSS 9.9 argument injection vulnerability in WordPress Toolkit before 6.11.0 allows remote authenticated users to bypass cross-tenant...
- Security
CVE-2025-6254: WordPress Doctreat Core Plugin Privilege Escalation (CVSS 9.8)
A critical unauthenticated privilege escalation vulnerability in the Doctreat Core WordPress plugin allows attackers to register with elevated roles,...
- News
Critical Everest Forms Pro Flaw Exploited to Take Over WordPress Sites
Hackers are actively exploiting a critical vulnerability (CVE-2026-3300) in the Everest Forms Pro WordPress plugin, enabling them to take complete control of…
- Security
CVE-2026-7537: MDJM Event Management WordPress Plugin Arbitrary File Upload
A high-severity arbitrary file upload vulnerability in the MDJM Event Management plugin for WordPress allows authenticated attackers to upload malicious files…
- Security
CVE-2026-7654: PHP Object Injection RCE in WordPress Admin Columns Plugin (≤ 7.0.18)
A high-severity PHP Object Injection vulnerability in the Admin Columns WordPress plugin (versions up to 7.0.18) allows authenticated attackers to achieve…
- Security
CVE-2026-9851: WordPress Booking Package Plugin Privilege Escalation via Account Takeover
A high-severity privilege escalation vulnerability in the Booking Package WordPress plugin allows unauthenticated or low-privileged attackers to take over…
- Security
CVE-2026-49777: CVSS 10 Flaw in WooCommerce Product Slider Pro Enables Malware Implantation
A maximum-severity input validation vulnerability in Product Slider Pro for WooCommerce allows attackers to implant malicious software. Affects all versions…
- News
Critical Kirki Flaw Exploited to Hijack WordPress Admin Accounts
Hackers are actively exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the widely-used Kirki Customizer Framework plugin for…
- Security
CVE-2026-8206: Kirki WordPress Plugin Critical Privilege Escalation via Account Takeover
The Kirki Freeform Page Builder plugin for WordPress (versions 6.0.0–6.0.6) allows unauthenticated attackers to take over any user account during password…
- Security
CVE-2026-8293: Really Simple Security WordPress Plugin 2FA Authentication Bypass
The Really Simple Security WordPress plugin before 9.5.10.1 fails to enforce the second-factor challenge on two REST API endpoints, allowing attackers with a…
- News
WP Maps Pro Bug Exploited to Create Admin Accounts on WordPress Sites
Hackers are actively exploiting a critical vulnerability in the WP Maps Pro WordPress plugin that allows unauthenticated attackers to create rogue…
- Security
CVE-2026-4290: WP Travel Pro Arbitrary User Deletion via Broken REST API Access Control
A critical CVSS 9.1 access control flaw in the WP Travel Pro WordPress plugin allows unauthenticated attackers to delete any user account — including...
- Security
CVE-2026-7459: WordPress Simple History Plugin Account Takeover
A broken authentication check in the Simple History WordPress plugin (versions up to 5.26.0) allows Subscriber-level users to take over any WordPress...
- Security
CVE-2026-7465: RCE in Spectra Gutenberg Blocks WordPress Plugin (CVSS 8.8)
A high-severity remote code execution vulnerability in the Spectra Gutenberg Blocks plugin for WordPress allows authenticated Contributor-level attackers...
- Security
CVE-2026-9757: GEO my WP Plugin SQL Injection via Query String Bypass
The GEO my WP WordPress plugin (versions up to 4.5.5) is vulnerable to unauthenticated SQL injection via the swlatlng and nelatlng parameters, which...
- Security
CVE-2026-3655: OTP Login WordPress Plugin Auth Bypass via Firebase Session Mismatch
A critical authentication bypass (CVSS 9.8) in the OTP Login With Phone Number WordPress plugin allows unauthenticated attackers to log in as any user due...
- Security
CVE-2026-8732: WP Maps Pro Privilege Escalation via Admin Account Creation
A critical unauthenticated privilege escalation flaw in WP Maps Pro for WordPress (CVSS 9.8) allows attackers to create administrator accounts without...
- Security
CVE-2026-39531: WP Directory Kit Blind SQL Injection (CVSS
A critical blind SQL injection vulnerability in the WP Directory Kit WordPress plugin allows unauthenticated attackers to exfiltrate the entire WordPress...
- Security
WP ERP Pro SQL Injection via search_key Parameter
A CVSS 7.5 SQL injection vulnerability in the WP ERP Pro WordPress plugin (all versions up to 1.5.1) allows unauthenticated attackers to extract sensitive...
- Security
CVE-2026-6279: Avada Builder Unauthenticated RCE via PHP
A critical CVSS 9.8 vulnerability in the Avada Builder (fusion-builder) WordPress plugin allows unauthenticated attackers to execute arbitrary PHP...
- Security
CVE-2026-7637: WordPress Boost Plugin PHP Object Injection
The Boost plugin for WordPress versions up to 2.0.3 is vulnerable to PHP Object Injection via deserialization of the STYXKEY-BOOST_USER_LOCATION cookie,...
- Security
CVE-2025-15609: Fortis for WooCommerce Plugin Leaks API
The Fortis for WooCommerce WordPress plugin before version 1.3.1 exposes sensitive API keys to unauthenticated attackers, enabling unauthorized access to...
- Security
CVE-2026-8719: WordPress AI Engine Plugin Privilege
A missing WordPress capability check in the AI Engine plugin's MCP OAuth bearer-token path allows any authenticated user to escalate privileges to...
- News
Funnel Builder Flaw Under Active Exploitation Enables
Attackers are actively exploiting a critical vulnerability in the Funnel Builder WordPress plugin to inject malicious JavaScript into WooCommerce checkout...
- Security
WordPress Form Notify Plugin Auth Bypass via LINE OAuth
The Form Notify plugin for WordPress is vulnerable to authentication bypass in versions up to and including 1.1.10. Attackers can manipulate...
- News
Avada Builder WordPress Plugin Flaws Allow Site Credential
Two vulnerabilities in the Avada Builder plugin for WordPress, with an estimated one million active installations, allow hackers to read arbitrary files...
- News
Funnel Builder WordPress Plugin Bug Exploited to Steal
A critical vulnerability in the Funnel Builder plugin for WordPress is being actively exploited to inject malicious JavaScript into WooCommerce checkout...
- Security
Critical Auth Bypass in InfusedWoo Pro Enables
A CVSS 9.1 authorization bypass in InfusedWoo Pro for WordPress lets unauthenticated attackers permanently delete arbitrary data across all installations...
- Security
CVE-2026-2993: SQL Injection in AIWU AI Chatbot WordPress
A high-severity SQL injection vulnerability (CVE-2026-2993) in the AI Chatbot & Workflow Automation by AIWU WordPress plugin allows unauthenticated...
- Security
CVE-2021-47932: WordPress TheCartPress 1.5.3.6 Privilege
TheCartPress WordPress plugin 1.5.3.6 allows unauthenticated attackers to register new administrator accounts by exploiting the AJAX handler with a...
- Security
CVE-2021-47933: WordPress MStore API 2.0.6 Arbitrary File
MStore API 2.0.6 for WordPress allows unauthenticated attackers to upload arbitrary PHP files via the REST API config_file endpoint, achieving remote code...
- Security
CVE-2026-6433: WordPress Plugin SQLi Enables
The Custom css-js-php WordPress plugin through version 2.0.7 fails to sanitize user input before using it in a SQL query, and passes the result to dynamic...
- Security
CVE-2026-5324: WordPress Brizy Page Builder Unauthenticated
The Brizy Page Builder plugin for WordPress contains a critical unauthenticated Stored Cross-Site Scripting flaw in versions up to 2.8.11, enabling...
- Security
CVE-2026-4882: Unauthenticated File Upload in WordPress
A critical unauthenticated arbitrary file upload vulnerability in the User Registration Advanced Fields plugin for WordPress allows attackers to upload...
- Security
CVE-2026-7458: Authentication Bypass via OTP Flaw in WordPress User Verification Plugin
A critical authentication bypass in the User Verification by PickPlugins plugin for WordPress allows unauthenticated attackers to bypass OTP verification...
- Security
Critical Authentication Bypass in WordPress Temporary Login
A critical CVSS 9.8 authentication bypass in the WordPress Temporary Login plugin (versions up to 1.0.0) allows unauthenticated attackers to gain...
- Security
CVE-2026-41940: WebPros cPanel & WHM and WP2 Missing
WebPros cPanel, WHM, and WP2 (WordPress Squared) contain a critical authentication bypass in the login flow, allowing unauthenticated remote attackers to...
- Security
CVE-2026-39440: FunnelFormsPro WordPress Plugin Remote Code
A critical code injection vulnerability in the FunnelFormsPro WordPress plugin through version 3.8.1 allows remote code inclusion, enabling attackers to...
- News
Hackers Actively Exploiting Breeze Cache File Upload Bug in WordPress Attacks
Threat actors are mass-exploiting a critical unauthenticated file upload vulnerability in the Breeze Cache WordPress plugin, uploading PHP webshells to...
- Security
CVE-2026-3844 — Breeze Cache WordPress Plugin
A critical unauthenticated file upload vulnerability in the Breeze Cache WordPress plugin allows attackers to upload arbitrary files to affected servers...
- Security
CVE-2026-4119: WordPress Create DB Tables Plugin
A critical CVSS 9.1 authorization bypass in the WordPress Create DB Tables plugin (all versions up to 1.2.1) allows unauthenticated users to create or...
- Security
CVE-2026-6518: WordPress CMP Plugin Arbitrary File Upload
The CMP Coming Soon & Maintenance Plugin for WordPress contains a critical arbitrary file upload flaw that allows subscriber-level authenticated users to...
- Security
CVE-2026-6443: WordPress Accordion Plugin Backdoor in Version 1.4.6
The Accordion and Accordion Slider WordPress plugin version 1.4.6 was sold to a malicious threat actor who embedded a persistent backdoor, granting...
- Security
CVE-2026-1830: WordPress Quick Playground Plugin RCE via Unauthenticated File Upload
A critical CVSS 9.8 vulnerability in the Quick Playground WordPress plugin (versions up to 1.3.1) allows unauthenticated attackers to upload arbitrary...
- Security
CVE-2026-4003: WordPress Users Manager PN Plugin Privilege
A critical privilege escalation vulnerability in the Users Manager – PN WordPress plugin (v1.1.15 and below) allows unauthenticated attackers to update...
- News
Hackers Exploit Critical Flaw in Ninja Forms WordPress
Attackers are actively exploiting a critical unauthenticated arbitrary file upload vulnerability in the Ninja Forms File Uploads premium add-on for...
- Newsletter
Apr 7 Digest: Medusa Ransomware Surge, FBI $21B Record
Storm-1175 runs sub-24-hour Medusa ransomware campaigns using zero-days; the FBI IC3 reports a record $21 billion in US cybercrime losses for 2025; North...
- Security
CVE-2026-3445: ProfilePress WordPress Plugin Allows
A high-severity authorization flaw in the ProfilePress WordPress plugin (up to v4.16.11) lets unauthenticated or low-privilege users bypass membership...
- Security
CVE-2026-4896: WCFM WooCommerce Plugin IDOR Allows
A high-severity Insecure Direct Object Reference vulnerability in the WCFM Frontend Manager for WooCommerce plugin (up to v6.7.25) lets authenticated...
- Security
CVE-2026-1540: Spam Protect CF7 WordPress Plugin PHP Log RCE
The Spam Protect for Contact Form 7 WordPress plugin before 1.2.10 allows an editor-level attacker to achieve Remote Code Execution by logging a crafted...
- News
File Read Flaw in Smart Slider Plugin Impacts 500K
A vulnerability in the Smart Slider 3 WordPress plugin, active on more than 800,000 websites, allows subscriber-level users to read arbitrary files on the...
- Security
CVE-2025-12886: Oxygen Theme SSRF Allows Unauthenticated
A Server-Side Request Forgery vulnerability in the Oxygen Theme plugin for WordPress (all versions up to 6.0.8) enables unauthenticated attackers to make...
- Security
CVE-2026-3629: WordPress User Import Plugin Privilege
The Import and export users and customers plugin for WordPress is vulnerable to privilege escalation in all versions up to 1.29.7, allowing authenticated...
- Security
CVE-2026-25449: Critical Object Injection in Shinetheme
A CVSS 9.8 deserialization vulnerability in the Shinetheme Traveler WordPress plugin allows unauthenticated remote attackers to inject arbitrary PHP...
- Security
Critical Auth Bypass in Tutor LMS Pro Exposes 30,000+
The Tutor LMS Pro WordPress plugin's Social Login addon fails to verify OAuth token email matches the login request, allowing unauthenticated attackers to...
- Security
CVE-2026-3589: WooCommerce CSRF Flaw Allows Unauthenticated
A cross-site request forgery vulnerability in WooCommerce versions 5.4.0 through 10.5.2 allows attackers to abuse the Store API's batch endpoint to...
- Security
Critical RCE in WPvivid Backup Plugin Threatens 900,000+
A critical unauthenticated arbitrary file upload vulnerability in the WPvivid Backup & Migration plugin allows remote code execution on over 900,000...
- Security
WordPress Plugin Vulnerability (CVSS 10.0) Under Active
Maximum severity flaw in Modular DS WordPress plugin allows unauthenticated privilege escalation. All versions through 2.5.1 affected with active...