WordPress 7.1.4 fixes 22 flaws, including upgrade RCE
The unauthenticated race needs a seconds-long update window and a web-reachable wp-content/upgrade directory; backports reach 4.7.39.
Stories per day · 30 days
4 RSS
Relatedwordpress2bricksforge1cve-2026-850971file-upload1interactivity-api1rce1remote-code-execution1stored-xss1web-shell1
26 stories, newest first · one card per story
Stories tagged #patchstack
WordPress Plugin Vulnerability Exploited in Attacks to Upload and eEecute Arbitrary PHP code
Attackers are exploiting unauthenticated Bricksforge flaw CVE-2026-85097 to upload and run arbitrary PHP.
4
Bricksforge WordPress Plugin Vulnerability Exploited in the Wild
Attackers are exploiting critical Bricksforge flaw CVE-2026-85097 for unauthenticated file upload and code execution.
1
Critical WordPress Bricksforge Flaw Lets Unauthenticated Attackers Execute Remote Code
Attackers are exploiting unauthenticated RCE CVE-2026-85097 in the WordPress Bricksforge plugin.
11
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
Attackers actively exploit CVSS 10.0 flaw CVE-2026-85097 in Bricksforge WordPress plugin for unauthenticated RCE.
5
Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin
Attackers are exploiting CVE-2026-85097, a CVSS 10 file-upload flaw in the Bricksforge WordPress plugin.
12
WordPress 7.1.3 Security Release
WordPress 7.1.3 patches seven flaws, including unauthenticated comment leaks and stored XSS, and is not an emergency.
16
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
Elementor CSRF in versions 4.3.0 and 4.3.1 can create admin accounts after one clicked link.
Elementor WordPress flaw lets attackers create admin accounts
Elementor 4.3.0 and 4.3.1 CSRF bug lets a malicious link create WordPress admin accounts.
Hackers Actively Exploiting WordPress Vulnerability to Execute Malicious Code
Attackers are exploiting WordPress LFI CVE-2026-87902 to write malicious PHP and seek remote code execution.
8
Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites
Elementor 4.3.0 and 4.3.1 have a CVSS 8.8 CSRF bug that can create a new administrator account.
Critical WordPress Vulnerability Exploited Immediately After Disclosure
Attackers began exploiting critical WordPress path-traversal CVE-2026-87902 for remote code execution within hours of disclosure.
1
Hackers start exploiting critical WordPress flaw for code execution
Attackers are exploiting critical WordPress flaw CVE-2026-87902 for unauthenticated code execution.
3
CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch
Attackers probed unauthenticated WordPress LFI CVE-2026-87902 within hours of the 7.1.2 patch.
5
WordPress 7.1.2 Security Release: Unauthenticated LFI to RCE
WordPress 7.1.2 fixes unauthenticated LFI CVE-2026-87902 that can reach remote code execution.
3
WordPress Click2Shell flaw lets hackers execute PHP on the server
Public PoC shows WordPress Click2Shell can run PHP if an administrator opens a crafted link.
1
Patchstack Now Protects Your AI-Built Apps
Patchstack launched Early Access security tooling for AI-built JavaScript apps on Lovable, Replit, Base44, and Claude Code, adding runtime mitigation and secret-leak blocking.
2
Launching managed CRA Article 14 reporting for open source maintainers
EU Cyber Resilience Act Article 14 reporting obligations begin, requiring 24-hour exploit and incident reports; Patchstack launches managed compliance for open-source maintainers.
2
Critical GiveWP Flaw Lets Attackers Run Commands on WordPress Servers
Critical unauthenticated PHP object injection (CVE-2026-82222) in the GiveWP WordPress donation plugin chains to remote code execution; version 4.16.7.2 fixes it.
2
Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP
Patchstack details an unauthenticated PHP object injection chain enabling remote code execution in the GiveWP WordPress donation plugin.
Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
Attackers are exploiting two unauthenticated WordPress auth bypasses (CVE-2026-61979, CVE-2026-15981, max CVSS 9.8) in miniOrange SAML SSO to gain admin sessions.
1
Case study: ManageWP Blocks 11.9M+ Threats in 6 Months with Patchstack
Patchstack case study says ManageWP blocked over 11.9M WordPress threats in six months, with top vulnerabilities weaponized in a median of five hours.
One slug, seven editions: the miniOrange SAML SSO bug that let anyone log in as your WordPress admin
DigitalOcean researchers reported a critical authentication flaw in miniOrange SAML SSO WordPress plugins, allowing login as WordPress admin across seven editions.
Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
Patchstack disclosed CVE-2026-32475 (CVSS 9.0), an unauthenticated file-upload flaw in Elementor Pro enabling PHP upload and RCE; fixed in version 4.2.2.
7