Critical Elementor Pro Flaw Enables Takeover of WordPress Sites
A critical vulnerability (CVE-2026-32475) in Elementor Pro is actively exploited to deliver webshells and execute commands on WordPress servers.
Tag
#WordPress
8 results in the archive.
GiveWP WordPress Plugin Flaw Lets Hackers Execute Server Commands
A critical vulnerability in the GiveWP donation plugin for WordPress allows unauthenticated attackers to execute arbitrary commands on the hosting server.
Critical Avada WordPress Theme Flaw Enables Zero-Click Remote Code Execution
A critical zero-click remote code execution vulnerability in the Avada WordPress theme allows unauthenticated attackers to execute arbitrary PHP code on affected servers.
StopAndProtect Uses 2,000 Hacked WordPress Sites to Spread Malware
The StopAndProtect campaign uses nearly 2,000 compromised WordPress sites worldwide to distribute malware and collect stolen data, impacting web infrastructure security.
WordPress Core SQL Injection Vulnerability CVE-2026-63030 Exploited
A critical SQL injection vulnerability identified as CVE-2026-63030 affects WordPress Core and is actively exploited, allowing unauthenticated remote code execution.
Critical wp2shell WordPress Flaw Allows Unauthenticated Code Execution
A critical vulnerability in WordPress core enables unauthenticated attackers to execute code on default installations, prompting urgent patch releases.
Exposed Server Reveals WP-SHELLSTORM Backdoor Targeting 1.4M WordPress Sites
A hacker group's exposed server revealed tools, logs, and a target list of over 1.4 million WordPress sites, exposing a large-scale WordPress backdoor campaign.
ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack
Attackers compromised ShapedPlugin's build pipeline to inject backdoor code into Pro plugins via official update channels. This supply chain attack puts thousands of WordPress sites at risk of remote exploitation.