Wordfence 9.1.0 adds a news widget, faster rules and login logging
Firewall parsing is tighter, rule checks are more frequent, and PHP 8.6 compatibility is included for every license.
Stories per day · 30 days
17 RSS
Relatedphp26rce23remote-code-execution20wordfence19php2shell18backdoor10race-condition9supply-chain9cisa8updraftplus8updraftcentral7kev6rank-math6sql-injection6plugins5credential-theft4mod-php4plugin4
236 stories, newest first · one card per story
Stories tagged #wordpress
GBHackers weekly bulletin lists 50 stories from November 2–6
The roundup's lead blurbs cite bank theft, exploited WordPress and Zyxel flaws, and an Android TV botnet takedown.
Terminal2Shell ‘zero-day’ is satire, not a confirmed flaw
Opening a terminal as a signed-in user is ordinary behavior, and the claimed CVSS 11.0 exceeds the official scale.
1
Automattic launches Spacefast to deploy vibe-coded apps
The service adds databases, authentication, uploads, email, and analytics, and connects to outside coding agents or a Git repository.
1
WordPress update race exposes sites to exploited CVE-2026-119977
WordPress 4.7-7.1.3 vulnerable to actively exploited race condition during core updates allowing remote code execution.
InfiniteWP Client NOSSL signing key recovered in 291.9 seconds
The NOSSL signing key in InfiniteWP Client 1.13.10 with 31 bits of entropy is recovered live in 291.9 seconds after permanent selection via a request parameter.
Wordfence logs 549 WordPress flaws, including core installer RCE
Seventeen were rated critical; 41 of 549 remain unpatched, and free firewall users get new rules after 30 days.
CISA flags WordPress RCE flaw as actively exploited in attacks
CISA added CVE-2026-119977 to its KEV catalog after attackers exploited the high-severity TOCTOU race condition in WordPress core upgrades.
CISA adds WordPress code execution vulnerability to KEV catalog
CVE-2026-119977 allows unauthenticated code execution during WordPress upgrades and is actively exploited.
CISA Adds WordPress Upgrade Flaw to KEV Catalog
CVE-2026-119977 allows remote code execution via race condition during WordPress upgrades.
CISA adds WordPress flaw to KEV catalog
CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog; Wordfence recorded over 18,500 exploitation attempts in 21 hours.
CISA adds WordPress Core TOCTOU flaw to KEV
CISA confirms active exploitation of CVE-2026-119977 allowing unauthenticated code execution during upgrades.
CISA adds WordPress TOCTOU vulnerability to KEV Catalog
CISA adds CVE-2026-119977, a TOCTOU race condition in WordPress Core, to KEV Catalog based on active exploitation.
Attackers exploit unpatched CryptoPayment Gateway WordPress flaw
Defused Cyber observed in-the-wild exploitation of CVE-2026-81648 in the CryptoPayment Gateway plugin, allowing deletion of arbitrary files and extraction of wallet credentials.
1
CISA KEV: WordPress Core TOCTOU race condition CVE-2026-119977
WordPress Core upgrade TOCTOU vulnerability enables unauthenticated code execution during staging.
Brotli vulnerability enables unauthenticated remote code execution on WordPress sites
CVE-2026-111497 corrupts memory in Brotli library used by WordPress for outbound responses; public proof-of-concept works against PHP 8.3.36.
Multiple XSS vulnerabilities patched in WordPress plugins October 2026
Sucuri publishes October 2026 roundup of medium and high-risk flaws in Elementor, LiteSpeed Cache, and WooCommerce.
WordPress core RCE under active attack; Wordfence blocks 58,693 attempts
CVE-2026-119977 in WordPress 4.7 through 7.1.3 can yield unauthenticated PHP execution during brief upgrades; 7.1.4 patches it.
3
WordPress core RCE drew 60,471 attack attempts in 24 hours
Wordfence blocked the attempts after WordPress 7.1.4; the count does not show how many sites were compromised.
PHP2Shell attacks root Palo Alto firewalls; WordPress largely spared
A China-linked group chained PHP2Shell with Fragnesia to plant root webshells on at least 25 PAN-OS firewalls.
Attackers probe WordPress core race; 62,969 attempts in a day
Unauthenticated attackers can reach the installer under wp-content/upgrade only while a full core package is unpacking.
1
Attackers target fresh WordPress core update flaw hours after patch
The unauthenticated race condition can yield remote code execution only during a short core-update window; Wordfence has not confirmed compromises.
1
Stock WordPress pingback can crash workers via Brotli CVE-2026-111497
WordPress does not ship Brotli, but libcurl unpacks attacker-supplied br replies before WordPress sees them.
WordPress 7.1.4 fixes 22 flaws, including RCE under attack
Wordfence says unauthenticated RCE in WordPress 4.7 through 7.1.3 drew more than 18,500 exploit requests in 21 hours; successful compromises are not confirmed.