#плагины
-
Stolen UpdraftCentral keys used to backdoor WordPress sites
Attackers breached TeamUpdraft and appear to have stolen UpdraftCentral keys that can issue commands to connected sites. Roughly 400,000 WordPress websites may be exposed.
-
Critical Bricksforge WordPress Flaw Under Active Exploitation
CVE-2026-85097, rated a maximum CVSS 10.0, lets unauthenticated attackers run arbitrary PHP on WordPress sites. Patchstack says exploitation began on October 7, 2026.
-
Elementor CSRF Flaw: One Click Hands Attackers Admin Rights
A flaw in the popular WordPress site builder lets an unauthenticated attacker create a rogue administrator account once a logged-in victim clicks a crafted link.
-
Plugin4Shell: Swapping Out a "Pinned" Plugin in Four AI Coding Agents
Air Security has described a vulnerability that lets the owner of a plugin repository slip malicious code to an AI agent even where the plugin is bound to a specific, verified version.
-
Hack of Admin Menu Editor Pro Developer Turned Updates Into a Backdoor on 1,500 WordPress Sites
The attacker gained access to the site of the developer behind a popular plugin and distributed malicious updates that create a hidden administrator account. At least 230 customers were affected.
-
Vulnerability in Popular WordPress Backup Plugin Threatens Takeover of Millions of Sites
An SQL injection in All-in-One WP Migration and Backup lets an unauthenticated attacker execute code and gain full control over a site. Only about a third of users have updated.