bleepingcomputer.com
Ghostscript flaw lets hackers hijack servers via PDF uploads
Critical vulnerability in Ghostscript could lead to remote code execution via PDF uploads, affecting WordPress and other systems running Ghostscript 9.21-10.07.1.
Wordpress
Stories tagged “Wordpress.”
30 stories
bleepingcomputer.com
Ninja Forms plugin flaw exploited to hack WordPress sites
Hackers are exploiting stored XSS vulnerabilities in Ninja Forms and WPC Product Bundles for WooCommerce plugins to install backdoors and create rogue admin accounts on WordPress sites.
thehackernews.com
New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution
WordPress fixes a new vulnerability that allows attackers to install themes without user interaction, potentially leading to code execution.
bleepingcomputer.com
Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites
Malicious versions of the Admin Menu Editor Pro plugin have affected 1,500 WordPress sites.
bleepingcomputer.com
Hackers Target WordPress Sites via Third-Party WooCommerce Plugin
Hackers exploit WooCommerce Wholesale Lead Capture plugin vulnerability to upload PHP backdoor. Wordfence blocks over 100,000 attacks.
bleepingcomputer.com
Critical Elementor Pro flaw exploited to take over WordPress sites
A critical vulnerability (CVE-2026-32475) in the Elementor Pro WordPress plugin is being actively exploited to upload webshells and execute arbitrary commands, affecting over 6 million installations. The flaw, patched on August 19, allows attackers to bypass file validati…
bleepingcomputer.com
SQL injection vulnerability in WordPress backup plugin exposes millions of sites to takeover attacks
All-in-One WP Migration and Backup plugin for WordPress has a high-severity SQL injection vulnerability that could allow attackers to take control of affected websites.
thehackernews.com
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Multiple critical security flaws in WordPress plugins and themes could lead to site takeover or remote code execution.
bleepingcomputer.com
GiveWP WordPress donation plugin flaw lets hackers execute server commands
GiveWP plugin vulnerability allows hackers to execute commands on hosting servers. Patchstack reports a maximum-severity vulnerability in GiveWP version 4.16.7.1.
bleepingcomputer.com
Critical Avada WordPress theme flaw enables zero-click RCE
Critical vulnerability in Avada WordPress theme can be exploited for arbitrary PHP code execution. CVE-2026-18431 affects Avada versions up to 7.16 and Fusion Builder plugin versions up to 3.16.
thehackernews.com
Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
Attackers are exploiting two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin, allowing them to sign in as any WordPress user, including administrators. The vulnerabilities, disclosed by Patchstack, are due to signat…
bleepingcomputer.com
Hackers target WordPress sites in miniOrange auth bypass attacks
Hackers are attempting to exploit two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign On plugin for WordPress. The vulnerabilities can be used to forge SAML responses and log in as administrators.
bleepingcomputer.com
Critical Elementor Pro bug exposes WordPress sites to RCE attacks
Elementor Pro plugin flaw allows attackers to execute arbitrary code on servers.
thehackernews.com
Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
A critical flaw in the Elementor Pro WordPress plugin, CVE-2026-32475, allows unauthenticated attackers to upload dangerous PHP files and achieve remote code execution.
thehackernews.com
StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data
Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, store stolen documents, screenshots, and activity logs created to track the status …
thehackernews.com
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites.
thehackernews.com
New WordPress Pre-Auth XSS Could Lead to PHP Code Execution - Patch ASAP
WordPress has fixed a pre-authentication reflected cross-site scripting (XSS) flaw in its login screen that affects every version of the content management system. The flaw can be chained into PHP code execution on the server when a logged-in administrator interacts with …
heise.de
Finding and Sealing Data Leaks on WordPress Websites
Many WordPress website operators are unaware that the platform's powerful JSON API can expose sensitive data without requiring a login, bypassing frontend authentication.
thehackernews.com
Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck. The vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill's …
bleepingcomputer.com
Critical wp2shell WordPress flaws exploited to install webshells
Hackers are exploiting the wp2shell critical vulnerability suite affecting WordPress Core to deploy persistent webshells and install malicious plugins on affected servers.
thehackernews.com
WordPress wp2shell Exploitation Grows as Public Exploit Fuels Mass Scanning
Attackers have begun to exploit two critical vulnerabilities in WordPress that, when combined together, enable unauthenticated remote code execution (RCE) and complete compromise of vulnerable websites.
bleepingcomputer.com
WordPress Core 'wp2shell' RCE flaws get public exploits, patch now
WordPress Core has been hit with critical 'wp2shell' remote code execution vulnerabilities, tracked as CVE-2026-63030 and CVE-2026-60137. Public exploits have been released, making it essential for administrators to patch their sites immediately.
bleepingcomputer.com
We Built a Vulnerability Vending Machine: AI Tokens in, Zero-Days Out
Researchers at Intruder used AI tokens to find a zero-day vulnerability in a popular WordPress plugin, demonstrating the potential of AI in vulnerability research.
9to5mac.com
WordPress just released a brand-new Apple TV app with thousands of free videos
WordPress has released a new Apple TV app called WordPress TV, which brings thousands of free videos to the big screen. The app features talks, tutorials, and WordCamp session recordings from WordPress meetups and events worldwide.
thehackernews.com
Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites
A cybercrime crew left a server open on the internet for three weeks, exposing its hacking tools, activity logs, and target lists naming over 1.4 million websites. The operation, tracked as WP-SHELLSTORM, is a webshell access brokerage that breaks into sites at scale, pla…
thehackernews.com
ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack, affecting Pro plugin builds distributed through the vendor's Easy Digital Downloads infrastructure. The compromised plugins incorporate a loader that fetches a payload from a remote se…
thehackernews.com
Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys
Hackers are exploiting a vulnerability in the Gravity SMTP WordPress plugin to expose API keys and other sensitive data. The flaw, tracked as CVE-2026-4020, affects around 100,000 sites.
techjuice.pk
Operation Endgame Cleans 14,971 Infected WordPress Sites Worldwide
An international police operation, part of 'Operation Endgame,' has dismantled a Russian-linked cybercrime network, cleaning nearly 15,000 infected WordPress sites globally.
bleepingcomputer.com
Hackers exploit info disclosure bug in Gravity SMTP WordPress plugin
Hackers are exploiting a vulnerability in the Gravity SMTP WordPress plugin, affecting 100,000 sites. The flaw allows unauthenticated access to sensitive information.
thehackernews.com
Operation Endgame Disrupts SocGholish Servers, Cleans 14,971 WordPress Sites
Dutch law enforcement, along with international counterparts, has disrupted SocGholish malware infrastructure and cleaned nearly 15,000 infected WordPress sites. The operation is part of an ongoing initiative to combat botnets and associated criminal infrastructures.