Tag: WordPress
This WordPress backdoor regrows from any surviving copy
Sucuri's SC backdoor hides in eight places and rebuilds itself from any one that survives cleanup.
WordPress core patch closes a path traversal that can run code
WordPress 7.1.2 closes a path traversal in get_page_template() that needs no account and can end in code execution on some…
A single line break turned a WordPress comment into a server shell
An anonymous commenter could plant a script that ran in an administrator's browser and, from there, uploaded a web shell…
A forgotten Cloudflare key turned 100,000 sites into a malware channel
Attackers used a long-lived Cloudflare API key stored in Brevo's own source code to push malware through the marketing platform's…
One link is enough to force a theme onto WordPress
WordPress 7.1.1 fixes a chain that installs a theme from the official directory from a single crafted link.
Two WordPress plugin bugs let attackers plant web shells
Wordfence and Defiant detail critical flaws in WooCommerce Wholesale Lead Capture and The Events Calendar, both reachable without credentials.
Super Forms upload bug draws 250,000 blocked exploit tries
Wordfence counts 440,000 exploit attempts against Super Forms and Elementor Pro file-upload flaws.
Patch rush for five WordPress add-ons after takeover-grade flaws
Five critical flaws across WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP open sites to takeover and code execution.