Search: “WP Engine”

"WP2Shell" Critical WordPress RCE Chain (CVE-2026-63030 & CVE-2026-60137)

CISA added the WordPress core pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137) to KEV after confirmed exploitation; WordPress 6.9.5 and 7.0.2 fix the flaws.

On July 17, 2026 WordPress disclosed CVE-2026-63030, a REST API route-confusion flaw, and CVE-2026-60137, a SQL injection in WP_Query, which chain to unauthenticated remote code execution on default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. CISA has added both to the Known Exploited Vulnerabilities Catalog and active exploitation is confirmed. Cloudflare deployed WAF rules at 17:03 UTC on July 17, and patches are available in WordPress 6.9.5 and 7.0.2.

Web discovery (articles for new exploits & KEV entries)·Sep 8, 16:27 UTC · 8d agoExploit / PoC in the wild 2 sourcesCVE-2026-63030CVE-2026-601371· 1 read

WordPress Blocks High-Risk Plugin Releases With New AI-Powered Automated Security Review

WordPress.org now runs AI-powered automated security reviews on every plugin release, automatically blocking high-risk updates before distribution to millions of sites.

WordPress launched an automated security review that combines multiple AI models and Jetpack Scan during a six-hour cooldown to score each plugin release; updates above the blocking threshold are automatically held back from the WordPress.org update API. The change follows a July 28 incident where a backdoor added to a plugin with roughly 20,000 active installations was detected during cooldown and never delivered; the Plugins Team removed it 26 minutes after a Wordfence notification. Blocked developers receive an email with findings and are advised to publish a corrected version rather than await manual appeal.

GBHackers·updated Sep 11, 16:33 UTC · 5d ago·first Sep 11, 05:49 UTC · 5d agoTools 7 sources1

WordPress Security Plugins: How to Choose the Right One

Sucuri's guide breaks WordPress security plugins into hardening, malware scanning, integrity monitoring, and filtering types, and explains how to evaluate and layer them.

The Sucuri guide explains that WordPress security plugins bundle five capabilities - hardening, malware detection, integrity monitoring, activity logging, and application-level filtering - and that plugins run only after WordPress loads, unlike server-level firewalls. It lists leading causes of compromise: outdated plugins and themes, weak or reused credentials, nulled premium software, insecure configuration, and shared-hosting cross-contamination. It concludes with evaluation criteria and a post-installation security checklist for owners without dedicated security teams.

Sucuri Blog·Sep 5, 03:01 UTC · 11d agoIndustry

New cPanel Critical Flaw Could Let Hosting Customers Run SQL as Database Root

The Hacker News·Aug 4, 10:36 UTC · Aug 4, 2026VulnerabilityCVE-2026-58048CVE-2026-58047

CVE-2026-58048: cPanel Bug Enables Full Database Administrator Access

Security Affairs·Aug 4, 12:29 UTC · Aug 4, 2026VulnerabilityCVE-2026-58048

FlyWP Adds Proactive Vulnerability Protection with Patchstack

FlyWP integrated Patchstack into its managed WordPress hosting platform via a new FlySecurity Pro add-on for proactive vulnerability protection.

FlyWP, a managed WordPress cloud hosting and server management provider, has integrated Patchstack vulnerability intelligence into its platform. The new FlySecurity Pro add-on gives customers proactive protection against WordPress vulnerabilities from a single dashboard. The announcement is a vendor partnership rather than a new flaw or incident.

Patchstack·Aug 17, 15:16 UTC · Aug 17, 2026Tools1

WordPress wp2shell Vulnerabilities Exploited in the Wild (CVE-2026 ...

Public exploit code emerged for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137); CISA set a July 24 patching deadline.

CVE-2026-63030 (REST API batch-route confusion) chained with CVE-2026-60137 (SQL injection in WP_Query's author__not_in) enables pre-authentication RCE in WordPress core, affecting versions 6.8.0-7.0.1. Multiple researchers published working PoCs on GitHub that extract password hashes, crack admin credentials, and upload malicious plugins. CISA added both CVEs to its KEV catalog with a July 24, 2026 deadline, and WordPress.org enabled forced auto-updates; fixes shipped in 6.8.6, 6.9.5, and 7.0.2.

Web discovery (articles for new exploits & KEV entries)·Sep 7, 14:13 UTC · 9d agoExploit / PoC in the wildCVE-2026-63030CVE-2026-60137

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution

The Hacker News·Aug 8, 08:07 UTC · Aug 8, 2026Vulnerability in the wildCVE-2026-646381

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.

Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.

The Hacker News·Sep 7, 14:36 UTC · 9d agoExploit / PoC in the wildCVE-2026-85046CVE-2026-86206CVE-2026-86207+7 CVEs

WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution

WordPress will automatically scan every plugin release and block high-risk updates from distribution using AI analysis plus Jetpack Scan.

WordPress announced automated security reviews for every plugin release during its cooldown period before distribution through the WordPress.org update API, combining AI models with Jetpack Scan into a security score. The system already caught a backdoor committed to a plugin with about 20,000 active installations on July 28, 2026, blocking it within 26 minutes of a Wordfence alert. Flagged patterns include missing capability checks, unsafe $wpdb queries, unserialize() on request data, and obfuscated code.

The Hacker News·Sep 14, 16:00 UTC · 2d agoTools

StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data

Check Point details StopAndProtect: ~2,000 compromised WordPress sites deliver ClickFix fake-CAPTCHA malware toolkit combining ransomware, credential theft, screenshots, and WhatsApp surveillance.

Check Point researcher Jaromír Hořejší reports the campaign begins with ClickFix fake-CAPTCHA prompts that trigger a PowerShell command, then two .NET downloader stages that launch six components: SilentEncryptor, NetworkShareScanner, a VBS spreader, LockScreen, SimpleChatProxy, and SilentDataCollector. Hacked WordPress sites host malware stages, serve C2 commands, and receive exfiltrated logs; the actors installed a self-deleting WordPress plugin enabling arbitrary PHP upload anywhere under the WordPress root. From mid-May to late July 2026 the operators exfiltrated more than 700 archives including screenshots every 30 seconds, keylogger output, and WhatsApp contact data, and opsec failures exposed their Visual Basic automation tooling and lists of nearly 2,000 compromised domains.

The Hacker News·Aug 20, 05:48 UTC · 27d agoThreat actor in the wild

WordPress 7.0.4 Release

WordPress releases 7.0.4 with a security fix and urges all sites to update immediately.

WordPress.org announced the availability of WordPress 7.0.4, a maintenance release containing a security fix. Because it is a security release, the project recommends updating sites immediately via the dashboard or a download from WordPress.org. The announcement gives no technical details about the flaw being patched.

WordPress.org · Security·Aug 12, 14:45 UTC · Aug 12, 2026Advisory

Risky Bulletin: Russia tells data centers to deploy drone defenses

Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.

The Russian government instructed data center operators to deploy protections against drone strikes under a presidential decree signed by Putin that allows temporary state administration of critical infrastructure operators failing to defend against Ukrainian hacks and drone strikes. Although data centers are not formally critical infrastructure in Russia, the decree applies to them because other sectors depend heavily on cloud services; Russia has more than 180 data centers, over 80% in the European region within range of Ukrainian strikes. The digest also reports a Dropbox breach affecting nearly 5,000 accounts via the Lenovo ID integration, spyware attacks on at least 14 Serbians using NoviSpy or Pegasus, and a password recovery attack targeting hundreds of thousands of X accounts tied to the new X Money service. Other items include a 14-hour compromise of Coder's Cloudflare infrastructure delivering malicious Terraform modules, donor data breaches at Davayte and You Are Not Alone via the Stripe/WooCommerce integration, a $2.5M Aquifer crypto heist, and a TVING breach exposing data of almost 40 million accounts.

Risky Business News·Sep 4, 03:02 UTC · 12d agoPolicy & legal

5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin

Unauthenticated second-order SQL injection found in All-in-One WP Migration and Backup plugin with 5+ million active installs.

Wordfence received a submission on August 14, 2026 for an unauthenticated second-order SQL injection vulnerability in the All-in-One WP Migration and Backup WordPress plugin. The plugin has more than 5 million active installations. The disclosure text does not include a CVE id, a patch version, or evidence of exploitation.

Wordfence·Sep 1, 15:26 UTC · 15d agoVulnerability

Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin

Wordfence researchers disclosed a critical unauthenticated authentication bypass in the WPMU DEV Dashboard plugin, enabling admin takeover and possible RCE.

During internal research on August 19, 2026, Wordfence discovered an authentication bypass in the WPMU DEV Dashboard WordPress plugin, which has roughly 350,000 active installations. Unauthenticated attackers can gain administrator access when Hub Single-Sign On is enabled, enabling complete site takeover. If an administrator-writable code mechanism such as the plugin or theme editor is available, the flaw can lead to remote code execution.

Wordfence·Aug 27, 17:41 UTC · 20d agoVulnerability

Plug 'n' Pray: Agentic LLM-based Detection of Potential Log File Exposures in Third-Party Content Management System Plugins

Agentic LLM analysis validates 79 log file exposures across 62 of the 300 most-installed WordPress plugins, covering 250M+ active installations.

Researchers built an agentic LLM-based framework combining static and dynamic analysis to automatically detect insecure log files created by WordPress plugins. Scanning the 300 most-installed plugins, which account for roughly 75% of all active installations in the official ecosystem, it produced 81 findings with 79 manually reproduced across 62 plugins. Insufficiently secured log files can disclose credentials and personal data and have led to website compromises. The authors derive a taxonomy of log path and protection patterns and best practices, finding multi-layered protection often absent.

arXiv cs.CR·Sep 15, 13:29 UTC · 1d agoResearch

Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites

Compromised Admin Menu Editor Pro update server distributed backdoored plugin versions installing web shells and hidden admin accounts on roughly 1,500 WordPress sites.

A threat actor with root-level access to adminmenueditor.com pushed trojanized Admin Menu Editor Pro versions 2.35 and 2.36 containing includes/wp-user-consent.php, which installed a web shell and created a hidden wp_-prefixed user account. At least 230 customers and roughly 1,500 sites installed the malicious update, with several hundred more downloads possibly affected. Developer Janis Elsts took the site offline after the attacker recompromised the clean 2.36 release; version 2.34 and the free plugin are believed unaffected.

BleepingComputer·Sep 15, 20:34 UTC · 1d agoMalware in the wild1

$20 per zero-day is already the WordPress plugin reality

TrendAI and CHT Security used an AI pipeline to find over 300 verified WordPress plugin zero-days at roughly $20 per vulnerability.

A pipeline built in three days by TrendAI and CHT Security, presented at Ekoparty Miami, paired AI-driven static analysis with automated Docker provisioning and Chrome DevTools MCP dynamic verification to surface more than 300 critical zero-days in WordPress plugins within 72 hours. The run consumed about 222 million tokens across 95 tasks, averaging roughly $20 per verified vulnerability, with findings including pre-auth RCE, SQL injection, privilege escalation, SSRF, and an AI-assembled downgrade attack chain. Dynamic verification eliminated over 80% of false positives, but manual review at 30-60 minutes per finding remains the bottleneck, straining ZDI and NIST triage backlogs.

Help Net Security·Aug 24, 04:21 UTC · 23d agoResearch1

Critical GiveWP Flaw Lets Attackers Run Commands on WordPress Servers

Critical unauthenticated PHP object injection (CVE-2026-82222) in the GiveWP WordPress donation plugin chains to remote code execution; version 4.16.7.2 fixes it.

Patchstack disclosed CVE-2026-82222 (CVSS 10.0), an unauthenticated PHP object injection in GiveWP versions through 4.16.7.1 that chains through TCPDF and Give\TestData gadget classes to arbitrary OS command execution as the web server user. On versions 4.16.5.1 and below, a default installation with one published donation form is enough to exploit, with no user interaction required. Version 4.16.7.2 blocks unsafe serialized data, hardens the gadget chain and cleans already-stored database records; a separate registration bypass issue remains unresolved.

Security Affairs·Aug 31, 07:54 UTC · 16d agoVulnerabilityCVE-2026-82222

PHP Webshell Campaign Targets WordPress Through Critical WooCommerce Plugin Bug

Wordfence blocked over 100,000 exploitation attempts against CVE-2026-27540 in WooCommerce Wholesale Lead Capture, letting attackers upload PHP webshells to WordPress sites.

Wordfence reported more than 100,000 blocked exploitation attempts against CVE-2026-27540 in the WooCommerce Wholesale Lead Capture plugin (roughly 6,000 active installs), which was disclosed and patched on February 20 in version 2.0.3.2. The unauthenticated AJAX handler wwlc_file_upload_handler reads permitted file extensions from the attacker-controlled request, enabling arbitrary file upload of PHP files such as shell.php that report host details and serve further upload forms. Attack activity peaked between June 4 and June 17, 2026, with additional waves on July 1 and August 30. Wordfence rates the flaw CVSS 9.8, while Patchstack's CVE record lists 9.0.

Infosecurity Magazine·15:00 UTC · 6h agoExploit / PoC in the wild 6 sourcesCVE-2026-27540

Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP

Patchstack details an unauthenticated PHP object injection chain enabling remote code execution in the GiveWP WordPress donation plugin.

Patchstack disclosed an unauthenticated remote code execution vulnerability in the GiveWP WordPress donation plugin. An attacker with no account can execute arbitrary commands on the server of an affected GiveWP site. The full chain is reachable when a site has one published donation form and one active payment gateway, a configuration the researcher describes as a common default.

Patchstack·Aug 28, 09:39 UTC · 19d agoVulnerability

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)

Wordfence's weekly report summarizes newly disclosed WordPress ecosystem vulnerabilities added to its intelligence database for August 24-30, 2026.

Wordfence published its weekly WordPress vulnerability report covering disclosures added to the Wordfence Intelligence Vulnerability Database between August 24 and August 30, 2026. The report directs site owners to review the aggregated vulnerabilities to determine whether their sites are affected. The published text provides no specific CVE identifiers or affected products.

Wordfence·Sep 3, 18:27 UTC · 13d agoAdvisory

Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin

Wordfence Argus found two critical unauthenticated RCE vulnerability chains in The Events Calendar WordPress plugin, active on over 600,000 sites.

Wordfence Argus identified two independent critical vulnerability chains in The Events Calendar WordPress plugin on August 21-22, 2026. Both chains originate in the plugin's widget-rendering pipeline and can lead to unauthenticated Remote Code Execution via two separate methods. The plugin is active on more than 600,000 websites.

Wordfence·Sep 14, 16:53 UTC · 2d agoVulnerability

Boost Engagement with Free Passkeys by Wordfence

Wordfence 9 introduces free passkey support, letting WordPress users log in without passwords and reducing authentication friction.

Wordfence announced that version 9 of its WordPress security plugin introduces passkeys. The feature removes the need for users to remember or copy passwords from a manager. Wordfence is offering the passkey capability for free.

Wordfence·Sep 15, 19:55 UTC · 1d agoTools

WordPress Plugins Compromised Without a Single File Change

Attackers poisoned bdThemes' JSON API feed to backdoor WordPress sites by serving malicious remote code without modifying plugin files.

Infosecurity Magazine reports a supply chain attack in which attackers poisoned a JSON feed used by bdThemes WordPress plugins. The compromised feed delivered malicious code that backdoored sites without changing any plugin files, evading file-integrity based detection. WordPress sites running the vendor's plugins were affected.

Infosecurity Magazine·Aug 10, 14:30 UTC · Aug 10, 2026Malware in the wild

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 17, 2026 to August 23, 2026)

Wordfence logged 240 disclosed vulnerabilities across 184 WordPress plugins and 17 themes for the week of August 17-23, 2026.

Wordfence's weekly WordPress vulnerability report for August 17-23, 2026 added 240 vulnerabilities to its Intelligence Vulnerability Database, affecting 184 plugins and 17 themes. 105 vulnerability researchers contributed during the period. WordPress administrators are advised to review the list to check whether their sites use affected components.

Wordfence·Aug 27, 14:56 UTC · 20d agoVulnerability

Critical WordPress Plugin Flaws Put Over 600,000 Websites at Risk of Takeover

Two CVSS 9.8 flaws in The Events Calendar WordPress plugin expose 600,000+ sites to unauthenticated RCE and admin takeover.

Wordfence Argus discovered CVE-2026-78006 and CVE-2026-78159 (both CVSS 9.8) in StellarWP's The Events Calendar plugin, affecting over 600,000 active installations. CVE-2026-78006 exploits PHP object injection via crafted pending comments to execute OS commands; CVE-2026-78159 abuses a specially prepared array to call WordPress functions, enabling admin password resets and subsequent RCE. Both flaws are unauthenticated and patched in version 6.17.4.1, released after reports on August 21-22, 2026.

Cyber Security News·updated 11:32 UTC · 9h ago·first Sep 15, 10:01 UTC · 1d agoVulnerability 3 sourcesCVE-2026-78006CVE-2026-78159

Wordfence Argus Finds Unauthenticated Arbitrary File Upload Vulnerability in Gravity Forms

Wordfence finds an unauthenticated arbitrary file upload flaw in Gravity Forms (1M+ installs) that can lead to remote code execution.

On August 9, 2026, Wordfence's Argus scanner discovered an unauthenticated arbitrary file upload vulnerability in the WordPress plugin Gravity Forms, estimated at over one million active installations. Attackers can write files with attacker-selected extensions to a public temporary upload directory, potentially enabling remote code execution. The post does not mention a CVE identifier or observed exploitation.

Wordfence·Sep 1, 17:47 UTC · 15d agoVulnerability

When a PNG Isn’t a PNG: WordPress Patches an Author-Level Imagick RCE

WordPress 7.0.4 patches an author-level RCE in how uploaded media is handed to ImageMagick.

WordPress maintenance release 7.0.4 includes a security fix that changes how uploaded media is passed to ImageMagick, closing a path that let a logged-in author turn a crafted image upload into remote code execution. Patchstack's analysis explains the flaw as a file-type handling issue where a PNG may not be treated as a PNG. The text does not mention a CVE ID or observed exploitation, but the flaw affects extremely widely deployed software.

Patchstack·Aug 12, 15:32 UTC · Aug 12, 2026Vulnerability

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)

Wordfence's weekly WordPress vulnerability report summarizes plugin and theme vulnerabilities disclosed and added to its database during the week ending September 6, 2026.

Wordfence published its weekly WordPress Vulnerability Report covering disclosures between August 31 and September 6, 2026. The report lists new vulnerabilities added to the Wordfence Intelligence Vulnerability Database and highlights contributors to WordPress Security. Administrators are advised to review the listed plugin and theme vulnerabilities to check whether their sites are affected.

Wordfence·Sep 10, 19:08 UTC · 6d agoAdvisory

Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales

Wordfence's AI-assisted Argus found a six-step critical RCE chain in the Avada WordPress theme, which has more than one million sales.

Wordfence reports that its Argus research uncovered a complex six-step exploit chain yielding critical remote code execution in the Avada WordPress theme, one of the best-selling themes with over one million sales. The company also notes AI-assisted submissions to its bug bounty program grew from 16% to roughly two-thirds of all reports in recent months. Sites running Avada should apply the patched release.

Wordfence·Aug 25, 18:02 UTC · 22d agoVulnerability

Metasploit Wrap Up: Lot of summer shells and fit http profiles

Metasploit 6.5 ships 13 new modules including RCEs for SonicWall SMA1000, Ghost CMS, Joomla JCE and Langflow, plus a Linux kernel LPE.

Rapid7's Metasploit wrap-up covers the 6.5 release, which adds 13 new modules, including remote code execution exploits for WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard and a Pix-for-WooCommerce plugin. The Fragnesia Linux kernel local privilege escalation (CVE-2026-46300) also landed. The release introduces HTTP malleable profiles, MCP functionality, Linux multi-fetch payloads and improved Windows on ARM support.

Rapid7 Blog·Aug 14, 21:27 UTC · Aug 14, 2026ToolsCVE-2026-46300