wordpress
New WordPress Flaw Bypasses Administrator Approval for Themes
WordPress released patches on September 17 addressing Click2Shell, a high-severity vulnerability allowing attackers to force theme installations from specially crafted links without requiring user interaction…
Hackers Just Compromised Seven WordPress Plugins Without Changing Any Code
A supply chain attack targeted BdThemes WordPress plugins by poisoning a remote JSON feed delivered through the admin dashboard. Attackers exploited an XSS vulnerability to…
Seven WordPress Plugins Compromised via Poisoned JSON Feed, Affecting 100,000+ Sites
Cybersecurity researchers at Wordfence disclosed a supply chain attack on August 11 that compromised seven WordPress plugins from BdThemes by poisoning a remote JSON data…
Hackers Are Draining 100,000 WordPress Sites Now
A security flaw in the Gravity SMTP plugin for WordPress is under active exploitation. Cybercriminals are abusing the bug, prompting urgent warnings for site owners…
Operation Endgame Cleans 14,971 Infected WordPress Sites Worldwide
International law enforcement disrupted SocGholish, a malware network linked to Russia’s Evil Corp, cleaning 14,971 hacked WordPress sites and seizing 106 servers. Authorities urge WordPress…
Hackers Exploit Critical Flaw in Everest Forms Pro WordPress Plugin
Hackers are actively exploiting a critical remote code execution flaw in the Everest Forms Pro WordPress plugin, tracked as CVE-2026-3300 with a CVSS score of…
Over 20,000 WordPress Websites Infected by Malicious Plugins in Supply Chain Attack
A major cybersecurity incident has compromised more than 20,000 websites built on WordPress after several popular plugins were found to contain hidden backdoors used to distribute malicious…
Critical WordPress Plugin Bug Can Now Hijack 60,000 Websites With Admin Access
A privilege management bug in the User Registration & Membership plugin allows anyone to register as a site administrator without credentials, with Wordfence blocking hundreds…
PTA Issues Cybersecurity Warning Over Vulnerable WordPress Plugins
The Pakistan Telecommunication Authority (PTA) has issued a cybersecurity advisory warning website administrators and developers about multiple security flaws in several vulnerable WordPress plugins, posing…
WordPress Introduces Telex a Fresh AI Playground for Developers
WordPress Telex took centre stage at WordCamp US 2025 when Automattic CEO Matt Mullenweg demonstrated the early tool to an audience of developers and site…
Hackers Exploit Critical WordPress Theme Flaw Worldwide
A critical RCE vulnerability (CVE‑2025‑5394) in versions 7.8.3 and earlier of the Alone Charity Multipurpose WordPress Theme is actively exploited. Over 120,000 attempts were recorded…
Millions at Risk as Gravity Forms WordPress Plugin Gets Backdoored
Patchstack has identified a critical supply chain attack targeting Gravity Forms, one of WordPress’s most widely used premium plugins. Ironically, this plug-in is installed on…
Millions at Risk! WordPress Sites Hijacked to Spread Malware via Ads!
WordPress malware is quietly escalating into a major threat as hackers exploit legitimate adtech platforms to deliver malicious payloads to millions of users. Meanwhile, recent…
