CVE-2026-93836high
Ninja Forms plugin flaw exploited to hack WordPress sites
Cybersecurity researchers have identified an active exploitation campaign targeting two WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, leveraging stored cross-site scripting (XSS) vulnerabilities to compromise websites. The attacks, first observed on October 4 against WPC Product Bundles for WooCommerce users and then on October 5 against Ninja Forms users, involve the…
vulnerability
New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution
WordPress has released patches addressing a new set of vulnerabilities within its core software. One of these flaws, dubbed "Click2Shell" by the reporting security firm pwn.ai, could enable a logged-in administrator to inadvertently install a theme from the official WordPress.org directory simply by opening a specially crafted web link, without requiring explicit user interaction to confirm…
breach
Most WordPress pros still lack a breach recovery plan
A recent survey of 319 WordPress professionals indicates that a significant majority lack a defined breach recovery plan, despite most having experienced at least one security incident. The survey, conducted by Melapress, a developer of WordPress security plugins, included agency staff, developers, designers, site owners, and administrators who build and manage WordPress sites professionally.…
patch
Malcious Admin Menu Editor Pro plugin backdoors 1,500 WordPress sites
A malicious version of the Admin Menu Editor Pro plugin for WordPress was distributed to over 200 customers, affecting at least 1,500 websites, after an attacker compromised the maintainer's website and pushed updates containing a backdoor. The incident, which began on Monday, September 14, involved the distribution of trojanized versions of the premium plugin.
vulnerabilitycritical
Hackers target WordPress sites via third-party WooCommerce plugin
Attackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress, enabling them to upload PHP backdoors to compromised sites. The flaw, identified as CVE-2026-27540, affects plugin versions 2.0.3.1 and older.
CVE-2026-32475critical
Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites
Reports indicate that a critical arbitrary file upload vulnerability within the Elementor Pro WordPress plugin is currently being actively exploited to compromise websites. The flaw, identified as CVE-2026-32475, allows attackers to upload malicious files to affected sites, potentially leading to full site compromise.
CVE-2026-76581critical
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Recent reports indicate the disclosure of five critical security flaws affecting various WordPress plugins and themes. These vulnerabilities, identified in products such as WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, collectively present risks ranging from authentication bypass to full site takeover and remote code execution (RCE). The findings highlight persistent security…
vulnerability
GiveWP WordPress donation plugin flaw lets hackers execute server commands
A critical vulnerability in the GiveWP plugin for WordPress, identified as CVE-2026-82222, allows an unauthenticated attacker to execute arbitrary commands on the hosting server. The flaw affects GiveWP versions up to and including 4.16.7.1. The plugin, which has over 100,000 installations, is used for collecting donations and managing fundraising campaigns.
vulnerabilitycritical
Critical Avada WordPress theme flaw enables zero-click RCE
A critical vulnerability chain in the Avada theme for WordPress, tracked as CVE-2026-18431, could allow an unauthenticated attacker to achieve zero-click remote code execution (RCE) on affected websites. The exploit combines six distinct security issues, resulting in a critical severity score of 9.8.
CVE-2026-61979critical
Two CVSS 9.8 Auth Bypasses in miniOrange SAML WordPress Plugin Were Exploited Before Any Database Even Listed the Paid Editions as Vulnerable
Two critical authentication bypass vulnerabilities, both rated CVSS 9.8, in the miniOrange SAML 2.0 Single Sign On WordPress plugin were actively exploited before public vulnerability databases accurately reflected the affected paid editions. These flaws, identified as CVE-2026-61979 and CVE-2026-15981, allowed unauthenticated attackers to forge SAML authentication responses and gain…
