Vulnerabilities
Tracked as CVE-2026-87902, the path traversal flaw allows remote, unauthenticated attackers to execute arbitrary code.
Hi, what are you looking for?
SecurityWeek
All posts tagged "WordPress"
Vulnerabilities
The bug lets attackers automatically install and preview themes and could lead to remote code execution.
Malware & Threats
Hackers used a compromised API key to deploy a Cloudflare worker that injected malicious scripts.
Vulnerabilities
Vulnerabilities in The Events Calendar can provide attackers with remote code execution capabilities.
Application Security
Tracked as CVE-2026-32475 (CVSS score of 9.8), the bug described as an arbitrary file upload issue in the function that handles form submissions.
Vulnerabilities
The high-severity SQL injection flaw (CVE-2026-19949) could allow unauthenticated attackers to achieve remote code execution.
Vulnerabilities
CVE-2026-61979 and CVE-2026-15981 are authentication bypass vulnerabilities affecting the MiniOrange SAML 2.0 SSO plugin.
Vulnerabilities
Tracked as CVE-2026-15748, the arbitrary file upload bug allows unauthenticated attackers to upload executable files.
Vulnerabilities
Attackers with Author-level user or higher permissions could exploit the flaw via malicious Postscript files.
Vulnerabilities
Exploitation of the new WordPress vulnerabilities tracked as CVE-2026-60137 and CVE-2026-63030 started soon after disclosure.
Vulnerabilities
Vulnerable WordPress plugin iterations leak API keys, secrets, tokens, server information, and other data.
Malware & Threats
Law enforcement and private partners took down 106 SocGholish C&C servers and domains as part of Operation Endgame.
Vulnerabilities
The flaw allows attackers to execute arbitrary code remotely and has been exploited in the wild for two months.
Vulnerabilities
Threat actors are exploiting vulnerable Kirki and Burst Statistics deployments to elevate privileges and take over websites.
Vulnerabilities
The vulnerability allows hackers to upload arbitrary files to a site’s server and achieve remote code execution.
Vulnerabilities
The issue allows attackers to inject SQL queries and extract sensitive information from the database.
Vulnerabilities
A critical-severity vulnerability in the King Addons for Elementor plugin for WordPress has been exploited to take over websites.
Vulnerabilities
The critical vulnerability allows attackers to read arbitrary emails, including password reset messages.
Vulnerabilities
Roughly 9 million exploit attempts were observed this month as mass exploitation of the critical vulnerabilities recommenced.
Vulnerabilities
The Post SMTP email delivery WordPress plugin is affected by a critical vulnerability and half of websites using it remain unpatched.
Vulnerabilities
CISA added CVE-2026-65660 to its KEV catalog, giving federal agencies a patching deadline of September 28.
Artificial Intelligence
Email Security
Artificial Intelligence
Artificial Intelligence
The US and China agreed to set up a communication mechanism for artificial intelligence-related incidents.
Malware & Threats
Artificial Intelligence
