Organization
13 Interestana reports mention Wordfence, newest first. Each is summarised from the original reporting and links back to its publisher.
Threat actors are actively exploiting a critical security vulnerability within the WooCommerce Wholesale Lead Capture, a premium WordPress plugin utilized by over 6,000 active installations. This flaw allows unauthenticated attackers to upload arbitrary files, including PHP backdoors, thereby achieving remote…
Malicious versions of the Admin Menu Editor Pro plugin for WordPress have been distributed to over 200 customers after a threat actor compromised the plugin's maintainer's website. This compromise allowed the attacker to push updates containing a backdoor that creates…
Hackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress, a widely used e-commerce extension. This exploit allows attackers to upload a PHP backdoor onto compromised websites.
A critical zero-day vulnerability, identified as "StyleSmuggler," is actively being exploited to compromise websites running on Magento and Adobe Commerce platforms. This vulnerability affects all versions of these e-commerce platforms, posing a significant threat to online businesses.
Threat actors have initiated over 440,000 exploit attempts targeting two critical security vulnerabilities within popular WordPress plugins, Super Forms and Elementor Pro. These findings were detailed by Wordfence, a cybersecurity firm specializing in WordPress security.
A critical SQL injection vulnerability has been identified in the All-in-One WP Migration and Backup plugin, a widely used tool for WordPress websites, potentially exposing millions of sites to remote code execution and complete takeover by unauthenticated attackers.
Multiple critical security flaws have been disclosed in several widely-used WordPress plugins and themes, posing significant risks of authentication bypass, account takeover, and arbitrary code execution for website administrators and users.
A critical vulnerability, rated at maximum severity, has been identified in the GiveWP plugin for WordPress, a popular tool used for online donations. This flaw allows an unauthenticated attacker to execute arbitrary commands on the hosting server.
A threat actor successfully compromised the upstream infrastructure of BdThemes, a developer known for its premium WordPress web-design tools, to create unauthorized administrator accounts on websites utilizing their plugins. The attack involved modifying a remote JSON feed that was delivered…
A cybercrime server, left exposed online for three weeks, has provided researchers with an unprecedented look into the WP-SHELLSTORM operation, a mass site-hacking campaign targeting WordPress installations. The server's contents included hacking tools, activity logs, and target lists comprising…
A critical vulnerability in the Ultimate Member WordPress plugin was disclosed this week, potentially impacting up to 200,000 websites. The security flaw, rated 8.8 out of 10 on the Common Vulnerability Scoring System (CVSS), allows unauthenticated attackers to gain full…
Multiple WordPress plugins developed by ShapedPlugin were compromised through a supply chain attack, with threat actors injecting backdoor code into Pro plugin releases distributed via official licensed update channels. The security firm Wordfence identified the compromise, stating that attackers tampered…
A critical vulnerability in the UpdraftPlus WordPress plugin was disclosed on March 11, 2024, potentially exposing over 3 million websites to severe security risks. The flaw, identified as CVE-2024-27774, allows unauthenticated attackers to execute arbitrary code on affected WordPress installations.