WordPress

Search everything

Mentions · 7d9
Mentions · 30d15
All mentions73
First seenAug 12, 2026
Last mentioned10h ago

Timeline

73 articles · newest first

Attackers probe WordPress core race; 62,969 attempts in a day

Unauthenticated attackers can reach the installer under wp-content/upgrade only while a full core package is unpacking.

The Hacker NewsOct 30, 14:08 UTC · 10h agoExploit / PoCExploited9 sources1

Attackers target fresh WordPress core update flaw hours after patch

The unauthenticated race condition can yield remote code execution only during a short core-update window; Wordfence has not confirmed compromises.

SecurityWeekupdated Oct 30, 14:08 UTC · 10h agofirst Oct 30, 12:04 UTC · 12h agoExploit / PoCExploited9 sources1

WordPress 7.1.4 fixes 22 flaws, including RCE under attack

Wordfence says unauthenticated RCE in WordPress 4.7 through 7.1.3 drew more than 18,500 exploit requests in 21 hours; successful compromises are not confirmed.

GBHackersupdated Oct 30, 14:08 UTC · 10h agofirst Oct 30, 07:15 UTC · 16h agoExploit / PoCExploited9 sources1

WordPress update RCE attacked hours after the 7.1.4 patch

Wordfence logged more than 18,500 requests to temporary installer paths in 21 hours; Core 4.7 through 7.1.3 is affected.

Cyber Security Newsupdated Oct 30, 14:08 UTC · 10h agofirst Oct 30, 06:05 UTC · 18h agoExploit / PoCExploited9 sources1

WordPress 7.1.4 fixes unauthenticated upgrade-window RCE under attack

Core 4.7 through 7.1.3 is affected; attackers poll a seconds-long staging window during full updates.

Wordfenceupdated Oct 30, 14:08 UTC · 10h agofirst Oct 29, 21:58 UTC · 1d agoExploit / PoCExploited9 sources1

WordPress 7.1.4 patches 22 flaws, including an upgrade-window RCE

Supported branches should install 7.1.4 or the matching legacy release; the advisory assigns no CVE IDs or scores.

GBHackersupdated Oct 30, 14:08 UTC · 10h agofirst Oct 29, 05:35 UTC · 1d agoVulnerability 9 sources1

WordPress 7.1.4 fixes 22 security flaws, including unauthenticated RCE

Exploitation needs a seconds-long update window and public access to wp-content/upgrade/; older branches are patched back to 4.7.39.

Cyber Security Newsupdated Oct 30, 14:08 UTC · 10h agofirst Oct 29, 02:31 UTC · 1d agoVulnerability 9 sources1

WordPress 7.1.4 fixes 22 flaws, including upgrade RCE

The unauthenticated race needs a seconds-long update window and a web-reachable wp-content/upgrade directory; backports reach 4.7.39.

Patchstackupdated Oct 30, 14:08 UTC · 10h agofirst Oct 28, 18:34 UTC · 2d agoVulnerability 9 sources1

WordPress 7.1.4 fixes upgrade RCE and multiple stored XSS bugs

Fixes are being backported through the 4.7 line, and automatic background updates should install 7.1.4.

WordPress.org · Securityupdated Oct 30, 14:08 UTC · 10h agofirst Oct 28, 17:13 UTC · 2d agoVulnerability 9 sources1

WP2Shell chains two WordPress flaws into admin and web-shell access

Seqrite’s proof of concept uses CVE-2026-63030 and CVE-2026-60137 but does not show widespread live exploitation.

Cyber Security NewsOct 20, 13:54 UTC · 10d agoExploit / PoCCVE-2026-63030 CVE-2026-601372 · 1 read

Chained WordPress flaws allow unauthenticated site takeover

WP2Shell chains CVE-2026-63030 and CVE-2026-60137; fixes are 6.8.6, 6.9.5 and 7.0.2.

GBHackersOct 20, 10:35 UTC · 10d agoExploit / PoCExploitedCVE-2026-63030 CVE-2026-601371

Critical WordPress Flaws Allow Attackers to Execute Remote Code Without Authentication

Seqrite details WP2Shell, an unauthenticated WordPress chain combining two core flaws into remote code execution.

GBHackersOct 17, 08:47 UTC · 13d agoExploit / PoCCVE-2026-63030 CVE-2026-6013710 · 3 reads

Critical WordPress Vulnerabilities Enable XSS, SQL Injection and Data Disclosure Attacks

WordPress 7.1.3 patches stored XSS, SQL injection, and unauthenticated disclosure of private-post comments.

Cyber Security NewsOct 7, 08:53 UTC · 23d agoVulnerability 5 sources21 · 2 reads

WordPress 7.1.3 Security Release

WordPress 7.1.3 patches seven flaws, including unauthenticated comment leaks and stored XSS, and is not an emergency.

Patchstackupdated Oct 7, 08:53 UTC · 23d agofirst Oct 6, 19:34 UTC · 24d agoVulnerability 5 sourcesCVE-2026-8790215 · 6 reads

WordPress 7.1.3 Maintenance and Security Release

WordPress 7.1.3 fixes seven vulnerabilities, including stored XSS, SQL injection, and unauthenticated disclosure of private comments.

WordPress.org · Securityupdated Oct 7, 08:53 UTC · 23d agofirst Oct 6, 17:00 UTC · 24d agoAdvisory 5 sources5 · 2 reads

[webapps] WordPress 7.0.2 - Path Travesal

Exploit-DB publishes a path traversal proof-of-concept against WordPress 7.0.2.

Exploit-DBOct 1, 00:00 UTC · Oct 1, 2026Exploit / PoC3 · 2 reads

U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog

CISA added actively exploited WordPress Core flaw CVE-2026-87902 to the Known Exploited Vulnerabilities catalog.

Security AffairsSep 26, 07:42 UTC · Sep 26, 2026Exploit / PoCExploitedCVE-2026-879025

WordPress Comment2Shell Vulnerability Lets Hackers Take Over Sites Through Comments

WordPress patched CVE-2026-93485, a stored XSS called Comment2Shell that can lead to admin-triggered command execution.

Cyber Security NewsSep 25, 12:16 UTC · Sep 25, 2026Exploit / PoCCVE-2026-934853 · 1 read

CISA Adds One Known Exploited Vulnerability to Catalog

CISA added actively exploited WordPress Core remote file inclusion CVE-2026-87902 to the KEV catalog.

CISA AdvisoriesSep 25, 12:00 UTC · Sep 25, 2026Exploit / PoCExploitedCVE-2026-879024

Hackers Actively Exploiting WordPress Vulnerability to Execute Malicious Code

Attackers are exploiting WordPress LFI CVE-2026-87902 to write malicious PHP and seek remote code execution.

Cyber Security NewsSep 25, 09:43 UTC · Sep 25, 2026Exploit / PoCExploitedCVE-2026-879027 · 2 reads

Critical WordPress Vulnerability Exploited Immediately After Disclosure

Attackers began exploiting critical WordPress path-traversal CVE-2026-87902 for remote code execution within hours of disclosure.

SecurityWeekSep 24, 07:12 UTC · Sep 24, 2026Exploit / PoCExploitedCVE-2026-879021 · 1 read

Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure

Threat actors actively exploit critical WordPress CVE-2026-87902 (RCE) shortly after its disclosure, with confirmed exploitation attempts.

The Hacker NewsSep 24, 05:36 UTC · Sep 24, 2026Exploit / PoCExploitedCVE-2026-879023 · 1 read

Hackers start exploiting critical WordPress flaw for code execution

Attackers are exploiting critical WordPress flaw CVE-2026-87902 for unauthenticated code execution.

BleepingComputerSep 23, 18:31 UTC · Sep 23, 2026Exploit / PoCExploitedCVE-2026-879023 · 1 read

WordPress security advisory (AV26-952)

WordPress before 7.1.2 is under active attack via CVE-2026-87902, an unauthenticated path traversal that can yield remote code execution.

Canadian Centre for Cyber SecuritySep 23, 15:35 UTC · Sep 23, 2026Exploit / PoCExploitedCVE-2026-879022 · 1 read

CVE-2026-87902 in WordPress Enables Conditional RCE

WordPress patches CVE-2026-87902, an unauthenticated path traversal that can enable conditional remote code execution.

SOCRadarSep 23, 13:50 UTC · Sep 23, 2026VulnerabilityCVE-2026-879021 · 1 read

Critical WordPress Flaw Lets Unauthenticated Attackers Execute Remote Code

WordPress 7.1.2 patches a critical CVSS 9.2 path traversal flaw (CVE-2026-87902) that could allow unauthenticated RCE under specific theme and server configurations.

GBHackersSep 23, 09:10 UTC · Sep 23, 2026Vulnerability 2 sourcesCVE-2026-879024 · 1 read

Chrome Update Fixes 108 Vulnerabilities Including Critical GPU, WebGL and ANGLE Flaws

Chrome 154 patches 108 vulnerabilities, including critical memory-safety flaws in ANGLE, GPU, and WebGL that could enable code execution.

GBHackersSep 23, 09:02 UTC · Sep 23, 2026VulnerabilityCVE-2026-95350 CVE-2026-95357 CVE-2026-95339+82

WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902)

WordPress 7.1.2 fixes a critical unauthenticated path traversal flaw (CVE-2026-87902) that could allow remote code execution.

Help Net SecuritySep 23, 09:01 UTC · Sep 23, 2026Vulnerability 2 sourcesCVE-2026-879021 · 1 read

CVE-2026-87902: how close is your WordPress to remote code execution?

Critical WordPress file inclusion flaw (CVE-2026-87902) allows RCE and has been present since version 4.7.0.

Security AffairsSep 23, 07:36 UTC · Sep 23, 2026VulnerabilityCVE-2026-879025 · 3 reads

Critical WordPress Core Vulnerability Lets Attackers Execute Code Without Logging In

WordPress 7.1.2 patches a critical unauthenticated remote code execution flaw (CVE-2026-87902) in the core template resolution mechanism.

Cyber Security NewsSep 23, 07:05 UTC · Sep 23, 2026VulnerabilityCVE-2026-879021 · 1 read

PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core

WordPress patched a critical unauthenticated path traversal that can enable PHP inclusion and RCE.

WordfenceSep 22, 22:21 UTC · Sep 22, 2026Vulnerability1 · 1 read

CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch

Attackers probed unauthenticated WordPress LFI CVE-2026-87902 within hours of the 7.1.2 patch.

PatchstackSep 22, 20:43 UTC · Sep 22, 2026Exploit / PoCExploitedCVE-2026-879025 · 4 reads

WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers

WordPress patched critical CVE-2026-87902 (CVSS 9.2), an unauthenticated flaw that can execute code on some servers.

The Hacker NewsSep 22, 18:03 UTC · Sep 22, 2026VulnerabilityCVE-2026-879023 · 1 read

Inside a Malicious, Stealthy WordPress Must Use Plugin

Wordfence analyzed WordPress malware installed as a must-use plugin that self-heals to survive removal.

WordfenceSep 22, 14:56 UTC · Sep 22, 2026MalwareExploited2 · 1 read

WordPress 7.1.2 Security Release: Unauthenticated LFI to RCE

WordPress 7.1.2 fixes unauthenticated LFI CVE-2026-87902 that can reach remote code execution.

PatchstackSep 22, 14:50 UTC · Sep 22, 2026VulnerabilityCVE-2026-879023 · 2 reads

WordPress 7.1.2 Release

WordPress 7.1.2 patches critical unauthenticated local file inclusion that can lead to remote code execution.

WordPress.org · SecuritySep 22, 14:01 UTC · Sep 22, 2026VulnerabilityCVE-2026-879029 · 6 reads

WordPress Patches ‘Click2Shell’ Vulnerability

WordPress 7.1.1 patches Click2Shell, a theme-preview flaw that can lead to remote code execution.

SecurityWeekSep 22, 10:22 UTC · Sep 22, 2026Vulnerability1

WordPress Click2Shell flaw lets hackers execute PHP on the server

Public PoC shows WordPress Click2Shell can run PHP if an administrator opens a crafted link.

BleepingComputerSep 21, 18:23 UTC · Sep 21, 2026Exploit / PoC1

Click2Shell WordPress Flaw Lets Hackers Execute PHP Code and Take Over Websites

WordPress 7.1.1 patches Click2Shell, which can force theme installs and enable PHP code execution.

GBHackersSep 21, 04:54 UTC · Sep 21, 2026Vulnerability2

Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation

GreyNoise tracks 'Red Heron' actor exploiting multiple vulnerabilities including novel ZyXEL CVE-2026-7273 and stealing 18,000+ government records.

GreyNoiseSep 21, 00:00 UTC · Sep 21, 2026Threat actorExploitedCVE-2026-7273 CVE-2026-34908 CVE-2026-34909+93 · 1 read

Related CVEs

by mentions

CVE-2026-8790296%8.1
Unauthenticated Local File Inclusion to RCE in WordPress Core (fixed in 7.1.2)
published Sep 22, 2026WordPress (WordPress.org) WordPress coreKEVPoC ×23
CVE-2026-6303011%9.8
WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
published Jul 17, 2026WordPress CoreKEVPoC ×7
CVE-2026-601375%5.9
WordPress Core SQL Injection via WP_Query author__not_in (CVE-2026-60137)
published Jul 17, 2026WordPress CoreKEV
CVE-2026-781758.8
PHP Object Injection to RCE in Tutor LMS WordPress Plugin (≤ 4.0.7)
published Sep 12, 2026Themeum Tutor LMS – eLearning and online course solution plugin for WordPress
CVE-2026-93485<1%7.1
Unauthenticated Stored DOM-Based XSS in WordPress Core Affecting 4.7–7.0
published Sep 18, 2026Automattic WordPress (core)PoC ×3
CVE-2026-3491090%10.0
Unauthenticated Command Injection in Ubiquiti UniFi OS Devices
published May 22, 2026Ubiquiti (ui) UniFi OSKEVPoC
CVE-2026-72733%8.8
Zyxel GS1900 Series Switches Stack-Based Buffer Overflow Vulnerability
published Jun 16, 2026Zyxel GS1900 Series SwitchesKEVPoC
CVE-2026-56271<1%9.3
Flowise before 3.1.0 (affected versions 3.0.13 and earlier) uses weak hardcoded default JWT secrets ('auth_token', 'refresh_token') and default audience and…
published Jul 12, 2026flowiseai flowise
CVE-2026-953228.3
GPU out-of-bounds write sandbox escape in Chrome on Android
published Sep 29, 2026Google Chrome on Android
CVE-2026-61979<1%8.1
Unauthenticated privilege escalation in miniOrange SAML SSO WordPress plugin
published Aug 13, 2026miniOrange SAML SP Single Sign On (WordPress plugin)

Appears with

WordPressproduct · 42
Patchstackorganization · 18
WordPressorganization · 16
Wordfenceorganization · 10
Anthropicorganization · 7
Wordfencevendor · 7
Patchstackvendor · 6
Automatticvendor · 5
pwn.aiorganization · 5
CISAorganization · 4
Mobile Repair Zoneproduct · 4
WordPress 7.1.1product · 4
WordPress.orgorganization · 4
WordPress Coreproduct · 4
Microsoftvendor · 3
Seqriteorganization · 3

Entities are extracted by the model from each article. First seen Aug 12, 2026, last mentioned 10h ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.