ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Wordfence”

14 stories in the last 30d

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 11Exploit / PoC 9Tools 6Advisory 2Policy & legal 2Phishing & fraud 1
SeverityAllcritical 1high 19medium 0low 4info 7

Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin

Wordfence Argus found two critical unauthenticated RCE vulnerability chains in The Events Calendar WordPress plugin, active on over 600,000 sites.

Wordfence Argus identified two independent critical vulnerability chains in The Events Calendar WordPress plugin on August 21-22, 2026. Both chains originate in the plugin's widget-rendering pipeline and can lead to unauthenticated Remote Code Execution via two separate methods. The plugin is active on more than 600,000 websites.

Wordfence · 2d agoVulnerability

Wordfence Argus Finds Unauthenticated Arbitrary File Upload Vulnerability in Gravity Forms

Wordfence finds an unauthenticated arbitrary file upload flaw in Gravity Forms (1M+ installs) that can lead to remote code execution.

On August 9, 2026, Wordfence's Argus scanner discovered an unauthenticated arbitrary file upload vulnerability in the WordPress plugin Gravity Forms, estimated at over one million active installations. Attackers can write files with attacker-selected extensions to a public temporary upload directory, potentially enabling remote code execution. The post does not mention a CVE identifier or observed exploitation.

Wordfence · 15d agoVulnerability

Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin

Wordfence researchers disclosed a critical unauthenticated authentication bypass in the WPMU DEV Dashboard plugin, enabling admin takeover and possible RCE.

During internal research on August 19, 2026, Wordfence discovered an authentication bypass in the WPMU DEV Dashboard WordPress plugin, which has roughly 350,000 active installations. Unauthenticated attackers can gain administrator access when Hub Single-Sign On is enabled, enabling complete site takeover. If an administrator-writable code mechanism such as the plugin or theme editor is available, the flaw can lead to remote code execution.

Wordfence · 20d agoVulnerability

Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales

Wordfence's AI-assisted Argus found a six-step critical RCE chain in the Avada WordPress theme, which has more than one million sales.

Wordfence reports that its Argus research uncovered a complex six-step exploit chain yielding critical remote code execution in the Avada WordPress theme, one of the best-selling themes with over one million sales. The company also notes AI-assisted submissions to its bug bounty program grew from 16% to roughly two-thirds of all reports in recent months. Sites running Avada should apply the patched release.

Wordfence · 22d agoVulnerability

Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

Attackers actively exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture plugin to upload PHP webshells; patch shipped in version 2.0.3.2.

CVE-2026-27540 (CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin affects versions 2.0.3.1 and earlier across roughly 6,000 active installations. The unauthenticated AJAX handler wwlc_file_upload_handler trusts a client-supplied file_settings allowlist, letting attackers upload shell.php for remote code execution. Wordfence has blocked more than 100,000 exploit attempts since disclosure, with spikes in June, July, and August 2026. The vendor fixed the flaw in version 2.0.3.2.

GBHackersupdated · 16h agofirst · 1d agoExploit / PoC in the wild 6 sourcesCVE-2026-27540

WordPress Events Calendar Vulnerabilities Let Hackers Take Over 600,000 Websites

Two unauthenticated RCE flaws (CVSS 9.8) in The Events Calendar WordPress plugin threaten 600,000 sites; patched in 6.17.4.1.

Wordfence Argus disclosed two critical unauthenticated vulnerability chains in The Events Calendar WordPress plugin, tracked as CVE-2026-78006 and CVE-2026-78159, both scoring 9.8 CVSS. CVE-2026-78006 enables PHP object injection leading to RCE via a Lazy_Post_Collection gadget chain, while CVE-2026-78159 abuses Element_Classes::parse_array() to invoke wp_update_user() and reset the admin password. Exploitation works by injecting wp:legacy-widget Gutenberg markup through comments, using WordPress's moderation-preview hash to trigger the block before approval. StellarWP patched both flaws in version 6.17.4.1 after Wordfence's August 2026 disclosure.

GBHackersupdated · 19h agofirst · 1d agoVulnerability 3 sourcesCVE-2026-78006CVE-2026-78159

Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Wordfence blocked 440,000+ exploit attempts against critical unauthenticated RCE flaws in WordPress plugins Super Forms and Elementor Pro.

Wordfence reports mass exploitation of two unauthenticated arbitrary file upload RCE flaws: CVE-2026-14894 in Super Forms (CVSS 9.8, fixed in 6.3.314) and CVE-2026-32475 in Elementor Pro (CVSS 9.0/9.8, fixed in 4.2.2), with over 250,000 and 190,000 blocked exploit attempts respectively. Attackers upload Base64-encoded PHP web shells such as Mushr00w_upl.php to execute code, create administrator accounts, exfiltrate data, or seize sites. Super Forms exploitation began July 14, 2026 and peaked above 40,000 requests on August 18; Elementor Pro attacks started August 19. Successful Elementor Pro exploitation requires a published page with a Form widget containing a File Upload field.

The Hacker News · 12d agoExploit / PoC in the wildCVE-2026-14894CVE-2026-32475

400,000 WordPress Sites Affected by Account Takeover Vulnerability in TranslatePress WordPress Plugin

Wordfence disclosed an unauthenticated account takeover flaw in the TranslatePress WordPress plugin, installed on over 400,000 sites, enabling full admin compromise.

On August 11, 2026, Wordfence received a submission for an unauthenticated account takeover vulnerability in TranslatePress, a WordPress plugin with more than 400,000 active installations. Unauthenticated attackers can obtain an administrator's password reset link, reset the account's password, and log in as that administrator. Full compromise of the affected site is possible without any authentication. Exploitation in the wild was not reported at disclosure.

Wordfence · 22d agoVulnerability

Risky Bulletin: Russia tells data centers to deploy drone defenses

Russia ordered data center operators to deploy drone strike defenses under a Putin decree allowing temporary state takeover of unprotected critical infrastructure.

The Russian government instructed data center operators to deploy protections against drone strikes under a presidential decree signed by Putin that allows temporary state administration of critical infrastructure operators failing to defend against Ukrainian hacks and drone strikes. Although data centers are not formally critical infrastructure in Russia, the decree applies to them because other sectors depend heavily on cloud services; Russia has more than 180 data centers, over 80% in the European region within range of Ukrainian strikes. The digest also reports a Dropbox breach affecting nearly 5,000 accounts via the Lenovo ID integration, spyware attacks on at least 14 Serbians using NoviSpy or Pegasus, and a password recovery attack targeting hundreds of thousands of X accounts tied to the new X Money service. Other items include a 14-hour compromise of Coder's Cloudflare infrastructure delivering malicious Terraform modules, donor data breaches at Davayte and You Are Not Alone via the Stripe/WooCommerce integration, a $2.5M Aquifer crypto heist, and a TVING breach exposing data of almost 40 million accounts.

Risky Business News · 13d agoPolicy & legal

Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin

Attackers are actively exploiting an unauthenticated arbitrary file upload flaw in the WooCommerce Wholesale Lead Capture plugin, enabling PHP backdoors and remote code execution.

A critical unauthenticated arbitrary file upload vulnerability in WooCommerce Wholesale Lead Capture, a premium WordPress plugin with an estimated 6,000 active installations, was publicly disclosed on February 20, 2026. Wordfence reports attackers are now actively exploiting the flaw to upload arbitrary files, including PHP backdoors, and achieve remote code execution. No CVE ID was cited in the report.

Wordfence · 2d agoExploit / PoC in the wild1

Risky Bulletin: BEC campaign steals €35 million from French notaries

Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.

A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.

Risky Business News · 10d agoPhishing & fraud in the wild1

Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin

Attackers are actively exploiting a critical unauthenticated file upload flaw in the Super Forms WordPress plugin to deploy PHP backdoors for RCE.

Wordfence disclosed on July 9, 2026 a critical unauthenticated arbitrary file upload vulnerability in the Super Forms WordPress plugin, which has roughly 13,000 active installations. Unauthenticated attackers can upload arbitrary files, including PHP backdoors, to achieve remote code execution. The vendor now reports that attackers are actively exploiting the flaw in the wild.

Wordfence · 13d agoExploit / PoC in the wild

5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin

Unauthenticated second-order SQL injection found in All-in-One WP Migration and Backup plugin with 5+ million active installs.

Wordfence received a submission on August 14, 2026 for an unauthenticated second-order SQL injection vulnerability in the All-in-One WP Migration and Backup WordPress plugin. The plugin has more than 5 million active installations. The disclosure text does not include a CVE id, a patch version, or evidence of exploitation.

Wordfence · 15d agoVulnerability

Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE

Five critical flaws (CVSS 9.8–10.0) in WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP enable WordPress admin takeover and RCE.

Wordfence and Patchstack disclosed five critical flaws in WordPress plugins and themes: WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. The issues include unauthenticated authentication bypass (CVE-2026-76581), arbitrary file write leading to RCE (CVE-2026-18431), administrator account takeover via password-reset URL exposure (CVE-2026-19632), privilege escalation (CVE-2026-19598), and PHP object injection to RCE (CVE-2026-82222, CVSS 10.0). Patchstack says the GiveWP flaw chains an unsafe unserialize helper, attacker-controlled donation data, and a gadget chain in shipped code.

The Hacker News · 18d agoVulnerabilityCVE-2026-76581CVE-2026-18431CVE-2026-19632+2 CVEs