Tag: WordPress

An Elementor WordPress flaw could let attackers create administrator accounts after a logged-in site administrator opens a malicious link. The issue affects Elementor versions 4.3.0 and 4.3.1. Elementor fixed it in version 4.3.2. Malicious Link Uses an Administrator’s Session The flaw involves cross-site request forgery, or CSRF. An attacker does not need an account on…

Attackers have moved from probing a WordPress RCE flaw to attempting to write malicious files onto vulnerable sites. Some observed payloads could run shell commands if someone accesses the files, according to security firm Patchstack. Attacks Began Hours After the Patch The vulnerability, CVE-2026-87902, received a critical severity score of 9.2 out of 10. WordPress…

The WordPress Zyxel attacks have exposed government-linked records and configurations from nearly 1,000 network switches, according to GreyNoise. Researchers attribute the activity to a Chinese-speaking threat actor operating across dozens of countries. GreyNoise connected the incidents through activity originating from the same IP address. Its sensors have recorded related scanning and exploitation since early June…

Security researchers have disclosed technical details and proof-of-concept code for a new WordPress vulnerability called Click2Shell. Attackers can exploit the flaw to install themes and execute arbitrary PHP code on vulnerable servers. WordPress 7.1.1 Fixes Click2Shell The WordPress Click2Shell flaw affects the platform’s Core component. WordPress addressed the security issue with the release of version…

Hackers are actively exploiting a critical WooCommerce plugin flaw to upload PHP backdoors to WordPress websites. Security researchers have recorded more than 100,000 attacks targeting vulnerable installations. The security issue affects the premium WooCommerce Wholesale Lead Capture plugin. Successful exploitation can give attackers full control of a website. Critical Vulnerability Enables File Uploads The vulnerability,…

A high-severity WordPress backup plugin flaw could let unauthenticated attackers take control of vulnerable websites. The issue affects All-in-One WP Migration and Backup, a widely used tool with more than five million active installations. Tracked as CVE-2026-19949, the vulnerability can lead to remote code execution when an administrator restores a site backup. ServMask fixed the…

A critical GiveWP WordPress vulnerability could let attackers execute commands on a vulnerable website’s hosting server. Site owners should update the donation plugin immediately. GiveWP flaw affects more than 100,000 sites The issue, tracked as CVE-2026-82222, affects GiveWP versions up to 4.16.7.1. GiveWP is a popular WordPress donation plugin with more than 100,000 active installations.…

Attackers are attempting to exploit two critical flaws in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. The vulnerabilities can be chained to bypass authentication and log in as a WordPress administrator. Security researchers have already detected scanning and exploitation attempts against vulnerable websites. Site owners using any affected miniOrange edition should manually…

A critical WordPress RCE vulnerability is being actively exploited, allowing attackers to take full control of vulnerable websites without a login or user interaction. The flaw, known as wp2shell, affects default WordPress installations and does not require a vulnerable plugin or special configuration. Security teams are urging administrators to update their sites immediately. WordPress has…

Public exploits are now available for two serious WordPress Core vulnerabilities known collectively as wp2shell. Attackers can combine the WordPress wp2shell flaws to execute malicious code on vulnerable websites without authentication. Security researchers have also detected early signs of exploitation in real attacks. The complete attack chain affects WordPress 6.9.0 through 6.9.4 and versions 7.0.0…