Earlier reports mentioning WordPress
Attackers are actively attempting to exploit two severe unauthenticated authentication bypass vulnerabilities within the Xecurify miniOrange SAML 2.0 Single Sign On plugin. These flaws enable malicious actors to bypass authentication mechanisms and log in as any WordPress user, including administrators…
Cybersecurity researchers have disclosed details of a critical flaw within the Elementor Pro WordPress plugin, a widely used page builder that empowers users to create custom website designs without extensive coding knowledge.
Cybersecurity researchers have identified a large-scale global cybercrime operation, dubbed StopAndProtect, that is leveraging nearly 2,000 compromised WordPress websites as its primary infrastructure. This operation is designed to disseminate malware, commandeer infected hosts, and serve as a repository for stolen…
The WPForms Lite WordPress plugin, a widely-used tool for creating forms on websites powered by the WordPress content management system, is currently facing accusations of introducing a backdoor vulnerability into new installations.
Cybersecurity researchers have identified a supply chain compromise targeting BdThemes, a vendor of plugins for the WordPress content management system (CMS). This attack involved the malicious modification of JSON files, which are commonly used for data interchange and configuration…
WordPress, the world's most dominant content management system (CMS) powering an estimated 40% of all websites, has recently addressed a critical pre-authentication reflected cross-site scripting (XSS) vulnerability. This flaw, officially designated as CVE-2026-64638, was present in all versions of WordPress…
Attackers have escalated exploitation of two critical vulnerabilities within WordPress, collectively known as wp2shell, which allow for unauthenticated remote code execution (RCE) and complete compromise of affected websites. The vulnerabilities, tracked as CVE-2026-63030 and CVE-2026-60137, became a significant concern following…
This week saw significant cybersecurity threats emerge, including critical vulnerabilities affecting widely used platforms. A remote code execution (RCE) flaw was identified in WordPress, allowing attackers to compromise websites with a single malicious request.
A critical vulnerability in WordPress core, identified as CVE-2024-XXXX, enabled unauthenticated attackers to execute arbitrary code on affected websites. The flaw, discovered by Adam Kues of Assetnote, a division of Searchlight Cyber, could be exploited through a simple anonymous HTTP…
A cybercrime server, left exposed online for three weeks, has provided researchers with an unprecedented look into the WP-SHELLSTORM operation, a mass site-hacking campaign targeting WordPress installations. The server's contents included hacking tools, activity logs, and target lists comprising…
The WPVibe WordPress plugin was released this week, providing a new method for users to connect artificial intelligence models to their websites. Developed to simplify the integration process, the plugin allows for the connection of virtually any AI service…
WordPress developers have expressed concerns that the platform's new AI features are diverting resources and attention from core functionalities that users have consistently requested. In a discussion highlighted by Search Engine Journal, developers voiced opinions that the integration of AI…
A critical vulnerability in the Ultimate Member WordPress plugin was disclosed this week, potentially impacting up to 200,000 websites. The security flaw, rated 8.8 out of 10 on the Common Vulnerability Scoring System (CVSS), allows unauthenticated attackers to gain full…