Search: “Wordfence”

49 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 107 Exploit / PoC 52 Malware 22 Threat actor 9 Phishing & fraud 7 Tools 6 Ransomware 4 Data breach 4 Advisory 2 Policy & legal 2 Industry 1

SeverityAll critical 119 high 64 medium 19 low 7 info 7

Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

Attackers actively exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture plugin to upload PHP webshells; patch shipped in version 2.0.3.2.

CVE-2026-27540 (CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin affects versions 2.0.3.1 and earlier across roughly 6,000 active installations. The unauthenticated AJAX handler wwlc_file_upload_handler trusts a client-supplied file_settings allowlist, letting attackers upload shell.php for remote code execution. Wordfence has blocked more than 100,000 exploit attempts since disclosure, with spikes in June, July, and August 2026. The vendor fixed the flaw in version 2.0.3.2.

GBHackersupdated 05:48 UTC · 8h agofirst Sep 15, 12:05 UTC · 1d agoExploit / PoC in the wild 4 sources CVE-2026-27540

Backup Migration WordPress Plugin Flaw Impacts 90,000 Sites

Infosecurity MagazineDec 12, 10:00 UTC · Dec 12, 2023Exploit / PoC CVE-2023-6553

100K+ WordPress sites using the Contact Form 7 Datepicker plugin are exposed to hack

Security AffairsApr 3, 08:50 UTC · Apr 3, 2020Exploit / PoC in the wild

Critical flaw in WooCommerce Payments plugin allows site takeover

Security AffairsMar 24, 14:45 UTC · Mar 24, 2023Exploit / PoC in the wild

0day in Fancy Product Designer WordPress plugin actively exploited

Security AffairsJun 2, 18:21 UTC · Jun 2, 2021Exploit / PoC in the wildCVE-2021-24370

A critical flaw in Rank Math WordPress plugin allows hackers to give users Admins privileges

Security AffairsMar 31, 21:43 UTC · Mar 31, 2020Exploit / PoC in the wild

Zero-Day flaws in 3 WordPress Plugins being exploited in the wild

Security AffairsOct 3, 14:05 UTC · Oct 3, 2017Exploit / PoC in the wild

Hackers‌ ‌Actively‌ ‌Exploiting‌ ‌0-Day‌ ‌in WordPress Plugin Installed on Over ‌17,000‌ ‌Sites

The Hacker NewsJun 3, 05:51 UTC · Jun 3, 2021Exploit / PoC in the wild

WordPress Sites Attacked in Their Millions

Infosecurity MagazineSep 7, 10:35 UTC · Sep 7, 2020Exploit / PoC

Issues in Elementor Pro and Ultimate Addons for Elementor exposed 1 Million WordPress sites at risk

Security AffairsMay 7, 22:58 UTC · May 7, 2020Exploit / PoC in the wild

Over 800K WordPress sites are at risk due to a flaw in Ninja Forms plugin

Security AffairsMay 1, 08:38 UTC · May 1, 2020Exploit / PoC in the wild

100k+ WordPress sites exposed to hack due to a bug in Real

Security AffairsApr 28, 09:03 UTC · Apr 28, 2020Exploit / PoC in the wild

Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Wordfence blocked 440,000+ exploit attempts against critical unauthenticated RCE flaws in WordPress plugins Super Forms and Elementor Pro.

Wordfence reports mass exploitation of two unauthenticated arbitrary file upload RCE flaws: CVE-2026-14894 in Super Forms (CVSS 9.8, fixed in 6.3.314) and CVE-2026-32475 in Elementor Pro (CVSS 9.0/9.8, fixed in 4.2.2), with over 250,000 and 190,000 blocked exploit attempts respectively. Attackers upload Base64-encoded PHP web shells such as Mushr00w_upl.php to execute code, create administrator accounts, exfiltrate data, or seize sites. Super Forms exploitation began July 14, 2026 and peaked above 40,000 requests on August 18; Elementor Pro attacks started August 19. Successful Elementor Pro exploitation requires a published page with a Form widget containing a File Upload field.

The Hacker NewsSep 4, 08:48 UTC · 12d agoExploit / PoC in the wildCVE-2026-14894 CVE-2026-32475

Sneeit WordPress RCE Exploited in the Wild While ICTBroadcast Bug Fuels Frost Botnet Attacks

The Hacker NewsDec 8, 09:15 UTC · Dec 8, 2025Exploit / PoC in the wildCVE-2025-6389 CVE-2025-2611 CVE-2025-1610

Attackers actively exploit critical zero

Security AffairsJul 31, 16:11 UTC · Jul 31, 2025Exploit / PoC CVE-2025-5394

Over 280,000 WordPress Sites Attacked Using WPGateway Plugin Zero

The Hacker NewsSep 15, 00:00 UTC · Sep 15, 2022Exploit / PoC in the wildCVE-2022-3180

Experts warn of attacks exploiting zero

Security AffairsSep 9, 11:50 UTC · Sep 9, 2022Exploit / PoC in the wildCVE-2022-31474

A flaw in The Plus Addons for Elementor WordPress plugin allows sites takeover

Security AffairsMar 10, 09:20 UTC · Mar 10, 2021Exploit / PoC in the wild

Critical flaws in Orbit Fox WordPress plugin allows site takeover

Security AffairsJan 17, 13:46 UTC · Jan 17, 2021Exploit / PoC

A critical flaw in wpDiscuz Wordpress plugin lets hackers take over hosting account

Security AffairsAug 2, 08:35 UTC · Aug 2, 2020Exploit / PoC

Zero-day in popular Yuzo Related Posts WordPress Plugin exploited in the wild

Security AffairsApr 12, 09:35 UTC · Apr 12, 2019Exploit / PoC in the wild

A critical flaw in WordPress GDPR compliance plugin exploited in the wild

Security AffairsNov 12, 10:08 UTC · Nov 12, 2018Exploit / PoC in the wild

OttoKit WordPress Plugin with 100K+ Installs Hit by Exploits Targeting Multiple Flaws

The Hacker NewsJul 18, 04:54 UTC · Jul 18, 2025Exploit / PoC in the wildCVE-2025-27007 CVE-2025-3102

Yellow Pencil WordPress Plugin flaw expose tens of thousands of sites

Security AffairsAug 28, 11:49 UTC · Aug 28, 2023Exploit / PoC

Researchers release PoC for Fortinet firewall flaw, exploitation attempts mount

Help Net SecurityOct 14, 00:00 UTC · Oct 14, 2022Exploit / PoC in the wildCVE-2022-40684

Hackers Exploit Zero-Day in WordPress BackupBuddy Plugin in ~5 Million Attempts

The Hacker NewsSep 10, 09:32 UTC · Sep 10, 2022Exploit / PoC in the wildCVE-2022-31474

Flaws in Popup Builder WordPress plugin expose 100K+ websites to hack

Security AffairsMar 13, 11:42 UTC · Mar 13, 2020Exploit / PoC in the wildCVE-2020-10196 CVE-2020-10195

Crooks are attempting to take over tens of thousands of WordPress sites

Security AffairsFeb 29, 16:15 UTC · Feb 29, 2020Exploit / PoC in the wild

Hackers are actively exploiting a Zero

Security AffairsFeb 20, 06:31 UTC · Feb 20, 2020Exploit / PoC in the wild

WordPress Social Warfare plugin zero

Security AffairsMar 24, 11:01 UTC · Mar 24, 2019Exploit / PoC in the wild

Hackers compromise WordPress sites via Zero

Security AffairsJan 28, 15:26 UTC · Jan 28, 2019Exploit / PoC in the wildCVE-2019-6703

WordPress King Addons Flaw Under Active Attack Lets Hackers Make Admin Accounts

The Hacker NewsDec 3, 17:09 UTC · Dec 3, 2025Exploit / PoC in the wildCVE-2025-8489

Hackers Exploit Critical WordPress Theme Flaw to Hijack Sites via Remote Plugin Install

The Hacker NewsJul 31, 06:53 UTC · Jul 31, 2025Exploit / PoC CVE-2025-5394

Critical flaw in Ninja Forms WordPress Plugin actively exploited in the wild

Security AffairsJun 19, 22:31 UTC · Jun 19, 2022Exploit / PoC in the wild

Critical Zero-Day in WordPress Plugin Under Active Attack

Infosecurity MagazineJun 2, 11:06 UTC · Jun 2, 2021Exploit / PoC in the wild

WordPress sites potentially exposed to hack due to Code Snippets flaw

Security AffairsJan 30, 13:56 UTC · Jan 30, 2020Exploit / PoC CVE-2020-8417

Recent WordPress flaw exploited to deface more than 1.5 million web sites

Security AffairsFeb 11, 09:11 UTC · Feb 11, 2017Exploit / PoC