Search: “givewp”

Critical GiveWP Flaw Lets Attackers Run Commands on WordPress Servers

Critical unauthenticated PHP object injection (CVE-2026-82222) in the GiveWP WordPress donation plugin chains to remote code execution; version 4.16.7.2 fixes it.

Patchstack disclosed CVE-2026-82222 (CVSS 10.0), an unauthenticated PHP object injection in GiveWP versions through 4.16.7.1 that chains through TCPDF and Give\TestData gadget classes to arbitrary OS command execution as the web server user. On versions 4.16.5.1 and below, a default installation with one published donation form is enough to exploit, with no user interaction required. Version 4.16.7.2 blocks unsafe serialized data, hardens the gadget chain and cleans already-stored database records; a separate registration bypass issue remains unresolved.

Security Affairs·Aug 31, 07:54 UTC · 16d agoVulnerabilityCVE-2026-82222

Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP

Patchstack details an unauthenticated PHP object injection chain enabling remote code execution in the GiveWP WordPress donation plugin.

Patchstack disclosed an unauthenticated remote code execution vulnerability in the GiveWP WordPress donation plugin. An attacker with no account can execute arbitrary commands on the server of an affected GiveWP site. The full chain is reachable when a site has one published donation form and one active payment gateway, a configuration the researcher describes as a common default.

Patchstack·Aug 28, 09:39 UTC · 19d agoVulnerability

"WP2Shell" Critical WordPress RCE Chain (CVE-2026-63030 & CVE-2026-60137)

CISA added the WordPress core pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137) to KEV after confirmed exploitation; WordPress 6.9.5 and 7.0.2 fix the flaws.

On July 17, 2026 WordPress disclosed CVE-2026-63030, a REST API route-confusion flaw, and CVE-2026-60137, a SQL injection in WP_Query, which chain to unauthenticated remote code execution on default installs of WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. CISA has added both to the Known Exploited Vulnerabilities Catalog and active exploitation is confirmed. Cloudflare deployed WAF rules at 17:03 UTC on July 17, and patches are available in WordPress 6.9.5 and 7.0.2.

Web discovery (articles for new exploits & KEV entries)·Sep 8, 16:27 UTC · 7d agoExploit / PoC in the wild 2 sourcesCVE-2026-63030CVE-2026-601371· 1 read

Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE

Five critical flaws (CVSS 9.8–10.0) in WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP enable WordPress admin takeover and RCE.

Wordfence and Patchstack disclosed five critical flaws in WordPress plugins and themes: WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. The issues include unauthenticated authentication bypass (CVE-2026-76581), arbitrary file write leading to RCE (CVE-2026-18431), administrator account takeover via password-reset URL exposure (CVE-2026-19632), privilege escalation (CVE-2026-19598), and PHP object injection to RCE (CVE-2026-82222, CVSS 10.0). Patchstack says the GiveWP flaw chains an unsafe unserialize helper, attacker-controlled donation data, and a gadget chain in shipped code.

The Hacker News·Aug 29, 16:25 UTC · 17d agoVulnerabilityCVE-2026-76581CVE-2026-18431CVE-2026-19632+2 CVEs

Boost Engagement with Free Passkeys by Wordfence

Wordfence 9 introduces free passkey support, letting WordPress users log in without passwords and reducing authentication friction.

Wordfence announced that version 9 of its WordPress security plugin introduces passkeys. The feature removes the need for users to remember or copy passwords from a manager. Wordfence is offering the passkey capability for free.

Wordfence·Sep 15, 19:55 UTC · 17h agoTools

FlyWP Adds Proactive Vulnerability Protection with Patchstack

FlyWP integrated Patchstack into its managed WordPress hosting platform via a new FlySecurity Pro add-on for proactive vulnerability protection.

FlyWP, a managed WordPress cloud hosting and server management provider, has integrated Patchstack vulnerability intelligence into its platform. The new FlySecurity Pro add-on gives customers proactive protection against WordPress vulnerabilities from a single dashboard. The announcement is a vendor partnership rather than a new flaw or incident.

Patchstack·Aug 17, 15:16 UTC · 29d agoTools1

WordPress wp2shell Vulnerabilities Exploited in the Wild (CVE-2026 ...

Public exploit code emerged for the WordPress wp2shell pre-auth RCE chain (CVE-2026-63030, CVE-2026-60137); CISA set a July 24 patching deadline.

CVE-2026-63030 (REST API batch-route confusion) chained with CVE-2026-60137 (SQL injection in WP_Query's author__not_in) enables pre-authentication RCE in WordPress core, affecting versions 6.8.0-7.0.1. Multiple researchers published working PoCs on GitHub that extract password hashes, crack admin credentials, and upload malicious plugins. CISA added both CVEs to its KEV catalog with a July 24, 2026 deadline, and WordPress.org enabled forced auto-updates; fixes shipped in 6.8.6, 6.9.5, and 7.0.2.

Web discovery (articles for new exploits & KEV entries)·Sep 7, 14:13 UTC · 8d agoExploit / PoC in the wildCVE-2026-63030CVE-2026-60137

Thousands of Hacked WordPress Sites, One Operation: Unmasking StopAndProtect

Check Point uncovers the StopAndProtect ransomware operation infecting thousands of WordPress sites via ClickFix social engineering and PowerShell downloaders.

Check Point Research first observed the StopAndProtect ransomware family in mid-May 2026 and linked its infrastructure to thousands of hacked WordPress sites. The infection chain begins with ClickFix social engineering that prompts victims to run a PowerShell command, followed by two stages of additional downloaders. The research maps the shared infrastructure unifying the operation.

Check Point Research·Aug 18, 13:05 UTC · 29d agoRansomware in the wild

PEEP: A Browser RAT Posing as a Chrome Extension

SOCRadar's STRU analyzed PEEP, an emerging Chromium-based RAT disguised as a Chrome extension enabling post-exploitation control of browsers.

SOCRadar's Threat Research Unit (STRU) identified and analyzed PEEP, a Chromium-based post-exploitation toolkit distributed as a browser extension. PEEP provides RAT-style capabilities while posing as a legitimate Chrome extension. It is assessed as an emerging threat worth monitoring by defenders.

SOCRadar·Sep 4, 09:50 UTC · 12d agoMalware

WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords

Gen Digital details WordlistLoader delivering Amatera Stealer via ClickFix and EtherHiding, while SynkLoader phishes Windows credentials through Microsoft Teams.

Gen Digital identified WordlistLoader, an intermediate stage that reconstructs shellcode encoded as plain English words (or 16-byte UUID chunks) and loads Amatera Stealer 4.3.3-alpha1, delivered through ClearFake ClickFix prompts on compromised websites. The chain uses EtherHiding to fetch JavaScript from a blockchain smart contract, hidden cmd.exe via conhost, WebDAV-mounted shares with rundll32 execution, and ETW bypass via hardware breakpoints. The stealer adds hardened WoW64 syscalls, Heaven's Gate indirect-syscall trampolines and a redesigned application-bound encryption bypass. Separately, Expel observed SynkLoader distributed via Microsoft Teams phishing impersonating IT service desks, installing an MSI from Azure blob storage and serving a fake lock screen to capture credentials.

The Hacker News·Aug 26, 05:08 UTC · 21d agoMalware

400,000 WordPress Sites Affected by Account Takeover Vulnerability in TranslatePress WordPress Plugin

Wordfence disclosed an unauthenticated account takeover flaw in the TranslatePress WordPress plugin, installed on over 400,000 sites, enabling full admin compromise.

On August 11, 2026, Wordfence received a submission for an unauthenticated account takeover vulnerability in TranslatePress, a WordPress plugin with more than 400,000 active installations. Unauthenticated attackers can obtain an administrator's password reset link, reset the account's password, and log in as that administrator. Full compromise of the affected site is possible without any authentication. Exploitation in the wild was not reported at disclosure.

Wordfence·Aug 25, 15:10 UTC · 21d agoVulnerability

New WordPress Pre-Auth XSS Could Lead to PHP Code Execution

The Hacker News·Aug 8, 08:07 UTC · Aug 8, 2026Vulnerability in the wildCVE-2026-646381

Case study: ManageWP Blocks 11.9M+ Threats in 6 Months with Patchstack

Patchstack case study says ManageWP blocked over 11.9M WordPress threats in six months, with top vulnerabilities weaponized in a median of five hours.

ManageWP reports blocking more than 11.9 million threats across managed WordPress sites in six months using Patchstack's vulnerability data and firewalling. The case study stresses that patching alone cannot close the gap, noting attackers weaponize the most-targeted WordPress vulnerabilities with a median of five hours. The piece is primarily vendor marketing aimed at agencies managing many sites.

Patchstack·Aug 24, 14:35 UTC · 22d agoIndustry

Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin

Wordfence researchers disclosed a critical unauthenticated authentication bypass in the WPMU DEV Dashboard plugin, enabling admin takeover and possible RCE.

During internal research on August 19, 2026, Wordfence discovered an authentication bypass in the WPMU DEV Dashboard WordPress plugin, which has roughly 350,000 active installations. Unauthenticated attackers can gain administrator access when Hub Single-Sign On is enabled, enabling complete site takeover. If an administrator-writable code mechanism such as the plugin or theme editor is available, the flaw can lead to remote code execution.

Wordfence·Aug 27, 17:41 UTC · 19d agoVulnerability

StopAndProtect Turns 2,000 Hacked WordPress Sites Into a Criminal Network

Check Point uncovered StopAndProtect, a cybercrime operation using ~2,000 hacked WordPress sites for ClickFix-driven malware delivery, data theft, surveillance, and ransomware.

Check Point Research identified the StopAndProtect operation in May 2026; it abuses close to 2,000 compromised WordPress sites, many running outdated software, to host malware stages, act as C2, and store stolen data. Infection starts with fake CAPTCHA ClickFix prompts that trick visitors into running a PowerShell command, followed by .NET downloaders deploying ransomware, SMB/USB worm, lockscreen, chat, and credential-stealing components. Rather than always encrypting, operators selectively exfiltrate file lists and specific files; researchers found 700+ stolen-data archives, roughly 31,000 screenshots, and 6,000+ unique victim IP addresses, including WhatsApp activity monitoring.

Security Affairs·Aug 20, 07:20 UTC · 27d agoThreat actor in the wild

$20 per zero-day is already the WordPress plugin reality

TrendAI and CHT Security used an AI pipeline to find over 300 verified WordPress plugin zero-days at roughly $20 per vulnerability.

A pipeline built in three days by TrendAI and CHT Security, presented at Ekoparty Miami, paired AI-driven static analysis with automated Docker provisioning and Chrome DevTools MCP dynamic verification to surface more than 300 critical zero-days in WordPress plugins within 72 hours. The run consumed about 222 million tokens across 95 tasks, averaging roughly $20 per verified vulnerability, with findings including pre-auth RCE, SQL injection, privilege escalation, SSRF, and an AI-assembled downgrade attack chain. Dynamic verification eliminated over 80% of false positives, but manual review at 30-60 minutes per finding remains the bottleneck, straining ZDI and NIST triage backlogs.

Help Net Security·Aug 24, 04:21 UTC · 23d agoResearch1

PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

SOCRadar disclosed PEEP, a post-exploitation Chromium extension toolkit that turns Chrome and Edge into host-level backdoors via native messaging and C2 polling.

SOCRadar researchers detailed PEEP, a Chromium-based post-exploitation toolkit masquerading as a 'Smart Bookmarks' extension injected directly into Chrome and Edge profiles by forging Secure Preferences integrity values, bypassing Web Store checks. A native-messaging host binary (nm_host.exe) extends the browser agent to host-level command execution, file management, credential theft, and session hijacking, while the extension polls C2 endpoints at 206.237.30.232 or xfjcc.fun every 30 seconds over plaintext HTTP and exfiltrates browsing history, cookies, and tab metadata. PEEP is derived from the open-source RedExt red teaming framework, adds PowerShell persistence scripts, and includes a Linux-targeting Python script, suggesting cross-platform intent. The activity is unattributed but contains Chinese-language artifacts; a C2 /health endpoint showed 34 agent entries and 10 active sessions.

The Hacker News·Sep 7, 18:12 UTC · 8d agoMalware in the wild

Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin

Wordfence Argus found two critical unauthenticated RCE vulnerability chains in The Events Calendar WordPress plugin, active on over 600,000 sites.

Wordfence Argus identified two independent critical vulnerability chains in The Events Calendar WordPress plugin on August 21-22, 2026. Both chains originate in the plugin's widget-rendering pipeline and can lead to unauthenticated Remote Code Execution via two separate methods. The plugin is active on more than 600,000 websites.

Wordfence·Sep 14, 16:53 UTC · 1d agoVulnerability

ZDI-26-588: Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability

ZDI disclosed a server-side request forgery in Fabric.js loadFromJSON (CVE-2026-19504) that can leak sensitive information from affected implementations.

Zero Day Initiative advisory ZDI-26-588 describes a server-side request forgery vulnerability in the Fabric.js canvas library's loadFromJSON function. Exploitation requires interaction with the library and attack vectors vary by implementation, potentially exposing sensitive information. The issue is rated 4.0 on the CVSS scale and tracked as CVE-2026-19504. The advisory does not report exploitation in the wild.

ZDI Published Advisories·Aug 24, 05:00 UTC · 23d agoVulnerabilityCVE-2026-19504

Why Johnny Can't Encrypt: A Usability Evaluation of PGP 5.0 (1999)

Seminal 1999 USENIX study finds most novice users cannot correctly sign and encrypt email with PGP 5.0 in 90 minutes.

Whitten and Tygar's USENIX Security Symposium paper evaluates whether cryptography novices can use PGP 5.0 effectively, using cognitive walkthrough analysis and a laboratory user test. The majority of test participants failed to successfully sign and encrypt a message within 90 minutes, despite PGP 5.0 having a well-regarded graphical interface. The authors argue that security requires usability standards beyond those of general consumer software and propose domain-specific UI design principles for security. The paper is a foundational reference in usable security research.

Lobsters · security·Sep 9, 06:47 UTC · 7d agoResearch

$536 and 8 Hours: AI Learns to Attack a Different PLC

Forescout used Claude to port a WAGO PLC exploit for $536 in 8 hours, and an AI-generated payload later permanently bricked the test device.

Forescout researchers used Claude Code with Ghidra, terminal access, and physical hardware to port CVE-2021-31886, a pre-authentication buffer overflow in the Nucleus FTP server, from a WAGO 750-852 PLC to the WAGO 750-831 without source code or debugger access. The final RCE development stage cost $535.74 in API fees over an 8-hour, 32-minute session (2.6k input and 1.3M output tokens) and required heavy researcher guidance. Claude produced working ICMP and UDP beacon exploits in 12 minutes after identifying that normal FTP command completion was overwriting its shellcode, fixed by omitting the CRLF terminator. A follow-up session extending the payloads toward a C2 implant wrote to flash-mapped memory and permanently bricked the PLC, underscoring the risks of autonomous agents operating against physical infrastructure.

Security Affairs·Sep 2, 13:50 UTC · 13d agoResearchCVE-2021-318861

Wordfence Bug Bounty Program Monthly Report – May 2026

Wordfence's May 2026 bug bounty monthly report logged 1,095 WordPress vulnerability submissions from researchers.

Wordfence's Bug Bounty Program received 1,095 vulnerability submissions in May 2026 from its researcher community. The Wordfence Threat Intelligence team reviews, triages, and processes submissions, responsibly disclosing validated vulnerabilities to WordPress ecosystem vendors. No specific flaws or exploitation details are provided in the report summary.

Wordfence·Sep 14, 13:58 UTC · 1d agoVulnerability

Closing the Blind Spot: Securing Personal Repositories in the Software Supply Chain

Wiz highlights personal developer repositories as a supply chain blind spot leaking corporate secrets, offering correlation-based risk validation and remediation.

Wiz argues that developers' personal code repositories are a blind spot in software supply chain security where corporate secrets quietly escape. The company describes an approach that correlates personal repositories to specific developers, validates the actual risk, and drives remediation. No specific incident or vulnerability is disclosed in the announcement.

Wiz Blog·Aug 13, 13:48 UTC · Aug 13, 2026Tools2

Show HN: LLM Attention Visualization

A developer released a browser-based tool that visualizes which past tokens influence each LLM output token using aggregated, value-weighted attention scores.

A Show HN project presents a React application built on Transformers.js that renders per-token attention influence by aggregating attention weights scaled by value-vector magnitudes across all attention heads and layers. To expose internal tensors, the author instrumented the ONNX computation graph, hosted a modified model on Hugging Face, and pre-generated prompts to avoid long model downloads in the browser. Demos with a 600-million-parameter model show how verbatim copying draws heavily on source tokens and how single outputs blend information from multiple phrases.

Hacker News · AI·Sep 8, 16:59 UTC · 7d agoAI tools & infraHN 41↑ · 9 comments

Wordfence Argus Finds Unauthenticated Arbitrary File Upload Vulnerability in Gravity Forms

Wordfence finds an unauthenticated arbitrary file upload flaw in Gravity Forms (1M+ installs) that can lead to remote code execution.

On August 9, 2026, Wordfence's Argus scanner discovered an unauthenticated arbitrary file upload vulnerability in the WordPress plugin Gravity Forms, estimated at over one million active installations. Attackers can write files with attacker-selected extensions to a public temporary upload directory, potentially enabling remote code execution. The post does not mention a CVE identifier or observed exploitation.

Wordfence·Sep 1, 17:47 UTC · 14d agoVulnerability

When Should LLMs Abstain? Chain-of-Self-Questioning for Selective Risk Control

Chain-of-Self-Questioning prompting cuts LLM wrong-answer commitments 32% relative while raising answered accuracy, holding across eleven model families.

The paper introduces Chain-of-Self-Questioning (CoSQ), a prompt-only framework that makes LLM answer commitment conditional on an explicit assessment of the information required to answer. On an 817-item TruthfulQA multiple-choice set, Grounded-CoSQ at τ=0.90 reduced mean unconditional wrong-commitment rate from 13.1% under chain-of-thought to 8.9% (a 32.1% relative reduction), while raising answered accuracy from 86.9% to 89.7% at 87.6% coverage. Improvements held across eleven open-weight and hosted model families and at every evaluated threshold, with convergent evidence from a Natural Questions short-answer evaluation.

arXiv cs.AI / cs.LG / cs.CL·Sep 15, 17:52 UTC · 19h agoAI research

WordPress Events Calendar Vulnerabilities Let Hackers Take Over 600,000 Websites

Two unauthenticated RCE flaws (CVSS 9.8) in The Events Calendar WordPress plugin threaten 600,000 sites; patched in 6.17.4.1.

Wordfence Argus disclosed two critical unauthenticated vulnerability chains in The Events Calendar WordPress plugin, tracked as CVE-2026-78006 and CVE-2026-78159, both scoring 9.8 CVSS. CVE-2026-78006 enables PHP object injection leading to RCE via a Lazy_Post_Collection gadget chain, while CVE-2026-78159 abuses Element_Classes::parse_array() to invoke wp_update_user() and reset the admin password. Exploitation works by injecting wp:legacy-widget Gutenberg markup through comments, using WordPress's moderation-preview hash to trigger the block before approval. StellarWP patched both flaws in version 6.17.4.1 after Wordfence's August 2026 disclosure.

GBHackers·updated 11:32 UTC · 1h ago·first Sep 15, 11:24 UTC · 1d agoVulnerability 3 sourcesCVE-2026-78006CVE-2026-78159