#wordpress
-
WordPress Core Flaw Hit by Tens of Thousands of Attacks a Day Right After Patch Release
Attackers began going after a remote code execution flaw in WordPress Core soon after it was patched. Wordfence says it blocked nearly 63,000 attempts in 24 hours.
-
Stolen UpdraftCentral keys used to backdoor WordPress sites
Attackers breached TeamUpdraft and appear to have stolen UpdraftCentral keys that can issue commands to connected sites. Roughly 400,000 WordPress websites may be exposed.
-
WordPress SEO plugin Rank Math PRO turned its own update channel into a backdoor pipeline
Copies of the paid Rank Math PRO plugin downloaded or delivered as an update between 20:02 UTC on October 15 and 07:12 UTC on October 16 carried malware. Any site that installed and activated one should be treated as compromised.
-
Critical Ghostscript flaw lets attackers hijack servers via PDF uploads
A heap buffer overflow in Ghostscript (CVE-2026-39919) opens the door to remote code execution through a specially crafted PDF file. WordPress sites are the primary target.
-
Critical Bricksforge WordPress Flaw Under Active Exploitation
CVE-2026-85097, rated a maximum CVSS 10.0, lets unauthenticated attackers run arbitrary PHP on WordPress sites. Patchstack says exploitation began on October 7, 2026.
-
CyberXero Wields Claude Code to Steal Over 628,000 Ukrainian Records
SOCRadar has detailed a two-pronged access-broker campaign that paired Cobalt Strike with a Claude Code orchestration layer and bypassed the model's safety controls by claiming each session was an "authorized pentest."
-
Elementor CSRF Flaw: One Click Hands Attackers Admin Rights
A flaw in the popular WordPress site builder lets an unauthenticated attacker create a rogue administrator account once a logged-in victim clicks a crafted link.
-
Critical WordPress RCE flaw: update without delay
A critical WordPress vulnerability can, under certain limited conditions, let an unauthenticated attacker run arbitrary code. Fixes have shipped for the current branch and been backported as far as version 4.7.
-
WordPress Comment2Shell: How a Comment Could Become a Server Takeover
A WordPress core flaw let an anonymous visitor plant a hidden script in a comment that fired when an administrator opened the page. The fix landed on September 17 in version 7.1.1.
-
Brevo supply-chain attack: a stolen Cloudflare key infected customer sites
Attackers stole a Cloudflare API key and used an edge worker to inject ClickFix scripts into Brevo's sites and into widgets embedded on customer pages. Up to 100,000 sites may have been affected.
-
A Temporary PHP Patch from 2014 Lived On Through 20 Million Installs
Developer Jake Smith has deprecated his http_build_url polyfill — 174 lines of code written as a stopgap for AOL's CMS that spread across millions of sites.
-
Hack of Admin Menu Editor Pro Developer Turned Updates Into a Backdoor on 1,500 WordPress Sites
The attacker gained access to the site of the developer behind a popular plugin and distributed malicious updates that create a hidden administrator account. At least 230 customers were affected.
-
Mullenweg back in the Automattic CEO chair two days after being ousted
Automattic founder Matt Mullenweg says he is running the company again — two days after the board of directors placed him on paid leave. He himself describes it as an attempted coup.
-
Automattic's Board Puts Founder Matt Mullenweg on Leave Against His Will
Matt Mullenweg, co-founder of WordPress and head of Automattic, says the board removed him from his post without his consent. CFO Mark Davies has become interim CEO.
-
5,400 hacked sites serve up ClickFix payloads from the BNB blockchain
A large cybercriminal campaign is using thousands of compromised small-business sites to deliver malicious code hidden inside smart contracts on the BNB Smart Chain test network.
-
Critical Elementor Pro Vulnerability Being Used to Hijack WordPress Sites
The recently patched CVE-2026-32475 vulnerability in the popular Elementor Pro plugin allows attackers to upload a web shell and execute arbitrary commands on the server. Wordfence has already blocked around 200,000 attack attempts.
-
Vulnerability in Popular WordPress Backup Plugin Threatens Takeover of Millions of Sites
An SQL injection in All-in-One WP Migration and Backup lets an unauthenticated attacker execute code and gain full control over a site. Only about a third of users have updated.
-
Five Critical Vulnerabilities in WordPress Plugins and Themes Threaten Site Takeover
Researchers at Wordfence and Patchstack have disclosed five critical flaws in popular WordPress add-ons — ranging from authentication bypass to remote code execution. WPMU DEV Dashboard, Avada, TranslatePress, Pods and GiveWP are all at risk.
-
ownCloud Flaw Used to Steal Nuclear Data in the Philippines
CISA added a critical ownCloud flaw to its exploited-vulnerabilities catalog after a Chinese-speaking group exfiltrated documents from a Philippine nuclear research center.
-
Critical Avada Theme Vulnerability for WordPress: Zero-Click RCE
A chain of six vulnerabilities in the popular Avada theme lets an unauthenticated attacker execute arbitrary PHP code on the server. The flaw was found by a Wordfence AI tool in under two hours.
- More