Tag

Wordpress

All articles tagged with #wordpress

WordPress 7.1.2 Patched as Attackers Escalate Exploitation of Critical Path Traversal Flaw

Attackers began exploiting a critical WordPress vulnerability within hours of its disclosure, escalating from reconnaissance to active remote code execution attempts. The flaw, CVE-2026-87902, allows unauthenticated attackers to load arbitrary PHP files if specific theme and server conditions are met. WordPress released version 7.1.2 to fix the issue, urging immediate updates as exploitation attempts surged tenfold.

via The Hacker News|

#cve-2026-87902 #cybersecurity #patchstack

security19 days ago•1 min saved

Attackers Exploit WordPress Path Traversal Flaw Within Hours of Patch Release

WordPress released version 7.1.2 on September 22 to fix CVE-2026-87902, a critical unauthenticated path traversal vulnerability. The flaw allows attackers to load arbitrary PHP files, potentially leading to remote code execution on servers with specific configurations. Attackers began exploiting the vulnerability within hours of the patch, escalating from reconnaissance to writing malicious files. Site owners are urged to update immediately, as the fix is backported to all supported branches down to version 4.7.

via The Hacker News|

#cve-2026-87902 #patchstack #path-traversal

cybersecurity19 days ago•2 min saved

WordPress 7.1.2 Patched as Attackers Exploit Critical Path Traversal Flaw

WordPress released version 7.1.2 on September 22 to fix CVE-2026-87902, a critical unauthenticated path traversal vulnerability. Attackers began exploiting the flaw within hours of the patch, escalating from reconnaissance to writing malicious files that execute shell commands. The vulnerability, rated 9.2/10, affects versions 4.7 through 7.1.1 and requires specific server configurations for full remote code execution.

via bleepingcomputer.com|

#cve-2026-87902 #cybersecurity #patchstack

technology2 months ago•4 min saved

WordPress XSS Chain Could Trigger Remote Code Execution, Patch Issued

Researchers disclosed a pre-auth, reflected XSS in WordPress login that can chain into PHP code execution on a site administrator's visit, via a multi-step path involving REST/JSONP calls and an attacker-controlled payload; the flaw, CVE-2026-64638, is rated 8.9/10 and affects all versions prior to the fix; WordPress released 7.0.3 on Aug 6 with backports to the 4.7 branch, and sites should update immediately; no known active exploits as of Aug 7.

via The Hacker News|

#cve-2026-64638 #rce #security

technology2 months ago•3 min saved

Active wp2shell flaws unleash automated WordPress webshell attacks

Hackers are abusing two critical WordPress flaws (wp2shell: CVE-2026-63030 and CVE-2026-60137) via the REST API batch-processing feature to execute code without authentication, enabling installation of malicious plugins and PHP webshells. WordPress patched versions 7.0.2, 6.9.5, and 6.8.6 with automatic updates. Security firms report mass scanning, plugin-upload abuse, admin credential harvesting, local file inclusion attempts targeting wp-config, and rogue admin accounts. Admins should update, audit logs, inspect plugins, and check /wp-content/cache for suspicious files; dashboards show ~81.6% patch rate in a sample of 124k sites. No lateral movement or data exfiltration observed yet, but monitoring continues.

via BleepingComputer|

#cve-2026-63030 #rest-api #technology

security2 months ago•4 min saved

Public WordPress wp2shell Exploit Triggers Global RCE Wave

Attackers are abusing two flaws, CVE-2026-63030 and CVE-2026-60137 (wp2shell), to achieve unauthenticated remote code execution on stock WordPress installs. Public PoCs and AI-assisted tooling have spurred widespread scanning and exploitation, including admin account creation, malicious plugins, and web shells like CMSmap. While automatic updates and some WAF protections have reduced risk, many sites may remain unpatched; defenders should patch immediately and audit for indicators of compromise such as new admins and suspicious plugins.

via The Hacker News|

#cve-2026-60137 #cve-2026-63030 #remote-code-execution

technology2 months ago•3 min saved

WordPress under attack: chained flaws enable pre-auth remote code execution after patches

After WordPress released patches for CVE-2026-60137 (SQL injection) and CVE-2026-63030 (REST API route confusion), attackers quickly weaponized both flaws to enable unauthenticated remote code execution. Public PoCs and AI-assisted tooling spurred rapid exploitation, with tens of thousands of attempts and hundreds of backdoor admin accounts, fake plugins, and attempts to fetch tools like Overlord RAT. WordPress also forced auto-updates for affected sites. Patches are in WordPress 6.9.5 and 7.1 Beta 2 (6.8.6 for the SQLi; older versions affected differently). Admins should patch immediately and audit for backdoors and suspicious plugins.

via The Register|

#cybersecurity #exploitation #remote-code-execution

technology2 months ago•5 min saved

Public PoCs Push Urgent Patch for WordPress wp2shell RCE

Public proof-of-concept exploits have surfaced for two chained WordPress Core flaws (CVE-2026-63030 and CVE-2026-60137) enabling unauthenticated remote code execution on WordPress 6.9.x and 7.0.x. WordPress released fixes in 6.9.5 and 7.0.2 with forced auto-updates; admins should patch immediately. Mitigations include blocking anonymous REST API access or specific endpoints, and Cloudflare has WAF protections. Tools like wp2shell.com let admins test vulnerability.

via BleepingComputer|

#cve-2026-60137 #cve-2026-63030 #rce

cyber-security2 months ago•24 min saved

Emergency Patch Rolled Out After wp2shell RCE Threat Targets WordPress

A critical, pre-authentication remote code execution flaw named wp2shell in WordPress Core affects roughly 500 million+ sites. It stems from a REST API batch-route confusion that enables unauthenticated attackers to execute code on vulnerable WordPress installations. The issue affects WordPress core versions 6.9.0–6.9.4, 7.0.0–7.0.1 (and 7.1 beta); fixes have been shipped in WordPress 7.0.2 with backports to 6.8.6 and 6.9.5. WordPress is auto-updating affected sites, and admins should update immediately. If patching isn’t possible yet, block anonymous REST API access or the batch endpoints as temporary mitigations and use the wp2shell.com scanner to check exposure.

via CyberSecurityNews|

#cve-2026-60137 #cve-2026-63030 #cyber-security

cybersecurity2 months ago•3 min saved

Unauthenticated WordPress core flaw forces urgent updates across 6.9/7.0 lines

An anonymous HTTP request can trigger remote code execution in WordPress core on affected 6.9.x and 7.0.x releases via the REST batch endpoint. WordPress patched 6.9.5 and 7.0.2 on July 17, 2026, after auto-updates began rolling out, but some sites may still be vulnerable if they didn’t receive the update. Mitigations before updating include blocking the batch endpoints at /wp-json/batch/v1 and rest_route=/batch/v1, disabling the REST API, or using a drop-in to filter anonymous batch requests. There is no CVE yet, and a tester at wp2shell.com lets site owners check exposure. The exact number of affected sites is unclear, though the vulnerable window covers recent WordPress releases only.

via The Hacker News|

#batch-endpoint #cybersecurity #pre-auth

technology4 months ago•3 min saved

Kash Patel's merch site hacked to push malware through a fake Cloudflare check

A Based Apparel storefront tied to Kash Patel was compromised: visitors encountered a modified Cloudflare verification page and were urged to copy a code into their terminal, which installed a Mac-specific infostealer malware designed to harvest credentials, browser data, crypto extension info, and keychain items, with a suspected payment skimmer also present. The attack leveraged a malicious WordPress plugin, while initial access remains unclear. Patel has distanced himself from the store, and there’s no confirmed FBI involvement at this time.

via Straight Arrow News - SAN|

#cloudflare #infostealer #malware

cybersecurity4 months ago•57 min saved

Admin Access Wipeout: Burst Statistics Plugin Flaw Exposes WordPress to Takeover

A critical vulnerability in the Burst Statistics WordPress plugin (versions 3.4.0–3.4.1.1, CVE-2026-8181) allows unauthenticated attackers to bypass authentication and impersonate an administrator via crafted REST API requests, potentially creating a new admin account and taking over a site. Discovered May 8, 2026 by Wordfence’s PRISM, it was patched in version 3.4.2 on May 12, 2026. The flaw stems from improper handling of authentication in the MainWP integration, enabling exploitation across REST endpoints. admins should immediate patch to 3.4.2+, audit user accounts, and monitor logs to prevent compromise.

via CyberSecurityNews|

#authentication-bypass #burst-statistics #cve-2026-8181

technology5 months ago•3 min saved

Breeze Cache Flaw Sparks Unauthenticated File Upload and RCE Risk

Hackers are actively exploiting a critical vulnerability in the Breeze Cache WordPress plugin (CVE-2026-3844) that allows unauthenticated attackers to upload arbitrary files, potentially enabling remote code execution. The flaw affects all versions up to 2.4.4 and was fixed in 2.4.5; exploitation is more likely if the Host Files Locally - Gravatars add-on is enabled. Update to the latest version or disable the Gravatar hosting option to reduce risk. The plugin has about 400,000 active installations, and hundreds of exploitation attempts have been observed.

via BleepingComputer|

#breeze-cache #cve-2026-3844 #remote-code-execution

tech7 months ago•46 min saved

WordPress launches a private, browser-based website sandbox

WordPress.org unveiled my.WordPress.net, an in-browser workspace that lets users build a private website without signing up, hosting, or a domain. The private sites run entirely in your browser (roughly 100MB of storage) and aren’t optimized for traffic or discovery, making it ideal for drafts, journaling, and experimenting with plugins, themes, and features—the data never leaves your device and is stored locally.

via The Verge|

#in-browser #plugins #private-site

technology1 year ago•3 min saved

WordPress Unveils Telex, an Experimental AI Tool

WordPress has introduced Telex, an experimental AI tool designed to help users create website content blocks more easily, reflecting the company's commitment to democratizing publishing through open-source AI innovations. Despite being in early stages and still facing some issues, Telex showcases WordPress's exploration into AI to enhance website building, alongside other AI tools and experiments. CEO Matt Mullenweg emphasized AI's potential to empower users and advance WordPress's mission, while also acknowledging ongoing legal disputes with WP Engine.

via TechCrunch|

#ai-development #ai-experimentation #gutenberg-blocks