#wordpress
-
Attacks on the miniOrange SAML SSO plugin for WordPress: login bypass grants admin rights
Attackers are mass-scanning WordPress sites for the Xecurify miniOrange SAML 2.0 SSO plugin, whose two vulnerabilities allow logging in as any user without authentication.
-
Critical Elementor Pro Vulnerability Opens the Door to Unauthenticated Code Execution
A flaw in the forms module of the popular WordPress plugin lets an unauthenticated attacker upload a PHP file and run arbitrary code. The patch landed on August 19.
-
BdThemes Supply-Chain Attack Creates Hidden WordPress Admins
An attacker compromised the infrastructure of premium plugin developer BdThemes and, through a poisoned JSON feed, created hidden administrator accounts on victims' sites.
-
Windmill Vulnerability Lets Attackers Read Server Files Without Authorization
VulnCheck has recorded attacks on the open-source Windmill platform via a directory traversal vulnerability. Around 170 systems across 24 countries are at risk.
-
Public Exploits Released for Critical wp2shell RCE Vulnerabilities in WordPress Core
Public exploits have surfaced for the critical wp2shell vulnerabilities in WordPress core, which allow arbitrary code execution on the server. Site administrators are urged to install the updates immediately.
-
Cloudflare Rolls Out WAF Rules to Protect WordPress Against Two Dangerous Vulnerabilities
Cloudflare has released two rules for its web firewall after the WordPress security team reported two high-severity vulnerabilities to it. The company stresses that the protection does not remove the need to update.
-
“A Vulnerability Vending Machine”: How AI Finds Zero-Days
Intruder has unveiled a system that automatically hunts for complex software vulnerabilities using code slicing and language models. It has already found and exploited a previously unknown zero-day in a WordPress plugin.
-
Unsecured Hacker Server Exposes Mass WordPress Site Compromise Campaign
Researchers gained access to a cybercriminal group's server that sat open on the internet for three weeks, getting an inside look at how a mass WordPress site compromise operation is run.