WordPress
WordPress security: plugin and theme vulnerabilities, supply-chain compromises and website takeovers. Check the affected extensions and versions before applying fixes.
Latest report:
Matching reports 20
-
Palo Alto confirms PHP2Shell attacks gaining root access
Palo Alto confirms PHP2Shell attacks gaining root access
-
WordPress update flaw draws attacks after 7.1.4 patch
WordPress update flaw draws attacks after 7.1.4 patch
-
Bricksforge RCE and two stored-XSS flaws draw attacks on WordPress sites
Attackers exploit Bricksforge flaw to upload files as PHP without login, risking site takeover. Update advised and check uploads for abuse.
-
WordPress Backdoor Uses Eight Recovery Points to Rebuild After Cleanup
WordPress SC backdoor rebuilds itself from 8 file, database and memory copies with Ethereum C2. Learn how it persists and how to clean it.
-
Elementor CSRF Flaw Can Turn One Administrator Click Into Full WordPress Control
Elementor 4.3.0-4.3.1 CSRF flaw lets attackers hijack admin sessions with one click to create rogue admins. Update to 4.3.2 immediately.
-
Attackers Turn WordPress Template Flaw Into Remote Code Execution Within Hours
Critical WordPress flaw CVE-2026-87902 is exploited within hours via pearcmd.php for RCE. Learn affected themes, attack chain, and fix in 7.1.2.
-
One Exploit Operator, Three Technology Stacks and Thousands of Exposed Government Records
Chinese-linked actor exploited WordPress, Zyxel and UniFi flaws to breach government networks, stealing 18,566 records and compromising 996 devices.
-
Click2Shell Turns a WordPress Admin Visit Into a Forced Theme Installation
WordPress patched Click2Shell flaw letting attackers trick admins into installing themes, chainable to RCE. Update to 7.1.1 now.
-
Critical Events Calendar Flaws Put More Than 200,000 WordPress Sites at Risk
Two critical 9.8 RCE flaws in The Events Calendar plugin expose 200,000+ WordPress sites. Update to version 6.17.4.1 to fix both vulnerabilities.
-
Attackers Exploit WooCommerce Plugin Flaw to Install PHP Web Shells
Attackers exploit CVE-2026-27540 in a WooCommerce plugin to upload PHP web shells. Learn the indicators, impact, and recommended defenses.
-
WordPress Under Attack: More Than 440,000 Attempts Target Super Forms and Elementor Pro
Over 440,000 attacks exploit critical unauthenticated file upload flaws in Super Forms and Elementor Pro, enabling remote code execution. Update now.
-
WordPress: RCE Vulnerability in All-in-One WP Migration Exposes Approximately 3.2 Million Sites
CVE-2026-19949 in All-in-One WP Migration up to 7.109 enables RCE via second-order SQL injection, exposing 3.2M sites. Update to 7.110 immediately.
How this coverage is selected
Articles are selected by explicit entity names or reviewed aliases in their original headlines, within the last 365 days. This is a chronology of our reporting, not a complete incident history. Separate stories do not imply a shared attack campaign. Read each article for its sources, affected versions and uncertainties.