tldrdailynews.com logo
Tag

Wordpress

All articles tagged with #wordpress

WordPress XSS Chain Could Trigger Remote Code Execution, Patch Issued
technology20 days ago

WordPress XSS Chain Could Trigger Remote Code Execution, Patch Issued

Researchers disclosed a pre-auth, reflected XSS in WordPress login that can chain into PHP code execution on a site administrator's visit, via a multi-step path involving REST/JSONP calls and an attacker-controlled payload; the flaw, CVE-2026-64638, is rated 8.9/10 and affects all versions prior to the fix; WordPress released 7.0.3 on Aug 6 with backports to the 4.7 branch, and sites should update immediately; no known active exploits as of Aug 7.

via The Hacker News|
#cve-2026-64638#rce#security
Active wp2shell flaws unleash automated WordPress webshell attacks
technology1 month ago

Active wp2shell flaws unleash automated WordPress webshell attacks

Hackers are abusing two critical WordPress flaws (wp2shell: CVE-2026-63030 and CVE-2026-60137) via the REST API batch-processing feature to execute code without authentication, enabling installation of malicious plugins and PHP webshells. WordPress patched versions 7.0.2, 6.9.5, and 6.8.6 with automatic updates. Security firms report mass scanning, plugin-upload abuse, admin credential harvesting, local file inclusion attempts targeting wp-config, and rogue admin accounts. Admins should update, audit logs, inspect plugins, and check /wp-content/cache for suspicious files; dashboards show ~81.6% patch rate in a sample of 124k sites. No lateral movement or data exfiltration observed yet, but monitoring continues.

via BleepingComputer|
#cve-2026-63030#rest-api#technology
Public WordPress wp2shell Exploit Triggers Global RCE Wave
security1 month ago

Public WordPress wp2shell Exploit Triggers Global RCE Wave

Attackers are abusing two flaws, CVE-2026-63030 and CVE-2026-60137 (wp2shell), to achieve unauthenticated remote code execution on stock WordPress installs. Public PoCs and AI-assisted tooling have spurred widespread scanning and exploitation, including admin account creation, malicious plugins, and web shells like CMSmap. While automatic updates and some WAF protections have reduced risk, many sites may remain unpatched; defenders should patch immediately and audit for indicators of compromise such as new admins and suspicious plugins.

via The Hacker News|
#cve-2026-60137#cve-2026-63030#remote-code-execution
WordPress under attack: chained flaws enable pre-auth remote code execution after patches
technology1 month ago

WordPress under attack: chained flaws enable pre-auth remote code execution after patches

After WordPress released patches for CVE-2026-60137 (SQL injection) and CVE-2026-63030 (REST API route confusion), attackers quickly weaponized both flaws to enable unauthenticated remote code execution. Public PoCs and AI-assisted tooling spurred rapid exploitation, with tens of thousands of attempts and hundreds of backdoor admin accounts, fake plugins, and attempts to fetch tools like Overlord RAT. WordPress also forced auto-updates for affected sites. Patches are in WordPress 6.9.5 and 7.1 Beta 2 (6.8.6 for the SQLi; older versions affected differently). Admins should patch immediately and audit for backdoors and suspicious plugins.

via The Register|
#cybersecurity#exploitation#remote-code-execution
Public PoCs Push Urgent Patch for WordPress wp2shell RCE
technology1 month ago

Public PoCs Push Urgent Patch for WordPress wp2shell RCE

Public proof-of-concept exploits have surfaced for two chained WordPress Core flaws (CVE-2026-63030 and CVE-2026-60137) enabling unauthenticated remote code execution on WordPress 6.9.x and 7.0.x. WordPress released fixes in 6.9.5 and 7.0.2 with forced auto-updates; admins should patch immediately. Mitigations include blocking anonymous REST API access or specific endpoints, and Cloudflare has WAF protections. Tools like wp2shell.com let admins test vulnerability.

via BleepingComputer|
#cve-2026-60137#cve-2026-63030#rce
Emergency Patch Rolled Out After wp2shell RCE Threat Targets WordPress
cyber-security1 month ago

Emergency Patch Rolled Out After wp2shell RCE Threat Targets WordPress

A critical, pre-authentication remote code execution flaw named wp2shell in WordPress Core affects roughly 500 million+ sites. It stems from a REST API batch-route confusion that enables unauthenticated attackers to execute code on vulnerable WordPress installations. The issue affects WordPress core versions 6.9.0–6.9.4, 7.0.0–7.0.1 (and 7.1 beta); fixes have been shipped in WordPress 7.0.2 with backports to 6.8.6 and 6.9.5. WordPress is auto-updating affected sites, and admins should update immediately. If patching isn’t possible yet, block anonymous REST API access or the batch endpoints as temporary mitigations and use the wp2shell.com scanner to check exposure.

via CyberSecurityNews|
#cve-2026-60137#cve-2026-63030#cyber-security
Unauthenticated WordPress core flaw forces urgent updates across 6.9/7.0 lines
cybersecurity1 month ago

Unauthenticated WordPress core flaw forces urgent updates across 6.9/7.0 lines

An anonymous HTTP request can trigger remote code execution in WordPress core on affected 6.9.x and 7.0.x releases via the REST batch endpoint. WordPress patched 6.9.5 and 7.0.2 on July 17, 2026, after auto-updates began rolling out, but some sites may still be vulnerable if they didn’t receive the update. Mitigations before updating include blocking the batch endpoints at /wp-json/batch/v1 and rest_route=/batch/v1, disabling the REST API, or using a drop-in to filter anonymous batch requests. There is no CVE yet, and a tester at wp2shell.com lets site owners check exposure. The exact number of affected sites is unclear, though the vulnerable window covers recent WordPress releases only.

via The Hacker News|
#batch-endpoint#cybersecurity#pre-auth
Kash Patel's merch site hacked to push malware through a fake Cloudflare check
technology3 months ago

Kash Patel's merch site hacked to push malware through a fake Cloudflare check

A Based Apparel storefront tied to Kash Patel was compromised: visitors encountered a modified Cloudflare verification page and were urged to copy a code into their terminal, which installed a Mac-specific infostealer malware designed to harvest credentials, browser data, crypto extension info, and keychain items, with a suspected payment skimmer also present. The attack leveraged a malicious WordPress plugin, while initial access remains unclear. Patel has distanced himself from the store, and there’s no confirmed FBI involvement at this time.

via Straight Arrow News - SAN|
#cloudflare#infostealer#malware
Admin Access Wipeout: Burst Statistics Plugin Flaw Exposes WordPress to Takeover
cybersecurity3 months ago

Admin Access Wipeout: Burst Statistics Plugin Flaw Exposes WordPress to Takeover

A critical vulnerability in the Burst Statistics WordPress plugin (versions 3.4.0–3.4.1.1, CVE-2026-8181) allows unauthenticated attackers to bypass authentication and impersonate an administrator via crafted REST API requests, potentially creating a new admin account and taking over a site. Discovered May 8, 2026 by Wordfence’s PRISM, it was patched in version 3.4.2 on May 12, 2026. The flaw stems from improper handling of authentication in the MainWP integration, enabling exploitation across REST endpoints. admins should immediate patch to 3.4.2+, audit user accounts, and monitor logs to prevent compromise.

via CyberSecurityNews|
#authentication-bypass#burst-statistics#cve-2026-8181
Breeze Cache Flaw Sparks Unauthenticated File Upload and RCE Risk
technology4 months ago

Breeze Cache Flaw Sparks Unauthenticated File Upload and RCE Risk

Hackers are actively exploiting a critical vulnerability in the Breeze Cache WordPress plugin (CVE-2026-3844) that allows unauthenticated attackers to upload arbitrary files, potentially enabling remote code execution. The flaw affects all versions up to 2.4.4 and was fixed in 2.4.5; exploitation is more likely if the Host Files Locally - Gravatars add-on is enabled. Update to the latest version or disable the Gravatar hosting option to reduce risk. The plugin has about 400,000 active installations, and hundreds of exploitation attempts have been observed.

via BleepingComputer|
#breeze-cache#cve-2026-3844#remote-code-execution
WordPress launches a private, browser-based website sandbox
tech5 months ago

WordPress launches a private, browser-based website sandbox

WordPress.org unveiled my.WordPress.net, an in-browser workspace that lets users build a private website without signing up, hosting, or a domain. The private sites run entirely in your browser (roughly 100MB of storage) and aren’t optimized for traffic or discovery, making it ideal for drafts, journaling, and experimenting with plugins, themes, and features—the data never leaves your device and is stored locally.

via The Verge|
#in-browser#plugins#private-site
WordPress Unveils Telex, an Experimental AI Tool
technology1 year ago

WordPress Unveils Telex, an Experimental AI Tool

WordPress has introduced Telex, an experimental AI tool designed to help users create website content blocks more easily, reflecting the company's commitment to democratizing publishing through open-source AI innovations. Despite being in early stages and still facing some issues, Telex showcases WordPress's exploration into AI to enhance website building, alongside other AI tools and experiments. CEO Matt Mullenweg emphasized AI's potential to empower users and advance WordPress's mission, while also acknowledging ongoing legal disputes with WP Engine.

via TechCrunch|
#ai-development#ai-experimentation#gutenberg-blocks
Hunk Companion Plugin Exploit Threatens Thousands of WordPress Sites
website-security1 year ago

Hunk Companion Plugin Exploit Threatens Thousands of WordPress Sites

A critical vulnerability in the WordPress Hunk Companion plugin, tracked as CVE-2024-11972, is being exploited by attackers to install other vulnerable plugins, leading to potential Remote Code Execution (RCE) and other attacks. The flaw affects all versions before 1.9.0 and allows unauthorized plugin installations, posing significant security risks. This vulnerability is a patch bypass for a similar flaw, CVE-2024-9707, and highlights the importance of securing WordPress components. Additionally, a high-severity flaw in the WPForms plugin has been disclosed, affecting millions of sites.

via The Hacker News|
#hunk-companion#plugin-exploitation#remote-code-execution
"Millions of WordPress Sites at Risk Due to Critical LayerSlider Plugin Flaw"
technology2 years ago

"Millions of WordPress Sites at Risk Due to Critical LayerSlider Plugin Flaw"

A critical SQL injection vulnerability (CVE-2024-2879) in the LayerSlider WordPress plugin, affecting versions 7.9.11 through 7.10.0, puts over one million sites at risk of data breaches and complete takeover. The flaw, discovered by researcher AmrAwad and reported to Wordfence, allows attackers to extract sensitive data from the site's database. The plugin's creator, Kreatura Team, released a security update (version 7.10.1) within 48 hours of notification, urging all users to upgrade immediately. WordPress site admins are advised to prioritize applying security updates, disable unnecessary plugins, use strong passwords, and deactivate dormant accounts to enhance site security.

via BleepingComputer|
#layerslider#plugin-update#security-vulnerability