Latest WordPress news

Hackers target Tatsu WordPress plugin in millions of attacks

Hackers are massively exploiting a remote code execution vulnerability, CVE-2021-25094, in the Tatsu Builder plugin for WordPress, which is installed on about 100,000 websites.
- Bill Toulas
- May 17, 2022
- 07:16 AM
- 0
Ukraine targeted by DDoS attacks from compromised WordPress sites

Ukraine's computer emergency response team (CERT-UA) has published an announcement warning of ongoing DDoS (distributed denial of service) attacks targeting pro-Ukraine sites and the government web portal.
- Bill Toulas
- April 28, 2022
- 11:38 AM
- 0
Critical flaw in Elementor WordPress plugin may affect 500k sites

The authors of the Elementor Website Builder plugin for WordPress have just released version 3.6.3 to address a critical remote code execution flaw that may impact as many as 500,000 websites.
- Bill Toulas
- April 13, 2022
- 10:51 AM
- 0
Launch your own WordPress site with this lifetime hosting deal

Developing and launching websites should be a simple process. The PixelHost WordPress Hosting Lifetime Subscription gives you efficient site construction and launch for $59, 83% off the MSRP of $360.
- BleepingComputer Deals
- April 05, 2022
- 02:07 PM
- 0
Hacked WordPress sites force visitors to DDoS Ukrainian targets

Hackers are compromising WordPress sites to insert a malicious script that uses visitors' browsers to perform distributed denial-of-service attacks on Ukrainian websites.
- Lawrence Abrams
- March 28, 2022
- 05:55 PM
- 0
Hundreds of GoDaddy-hosted sites backdoored in a single day

Internet security analysts have spotted a spike in backdoor infections on WordPress websites hosted on GoDaddy's Managed WordPress service, all featuring an identical backdoor payload.
- Bill Toulas
- March 16, 2022
- 01:22 PM
- 0
Nearly 30% of critical WordPress plugin bugs don't get a patch

Patchstack, a leader in WordPress security and threat intelligence, has released a whitepaper to present the state of WordPress security in 2021, and the report paints a dire picture.
- Bill Toulas
- March 09, 2022
- 04:33 PM
- 0
Ukrainian sites saw a 10x increase in attacks when invasion started

Internet security companies have recorded a massive wave of attacks against Ukrainian WordPress sites since Russia invaded Ukraine, aiming to take down the websites and cause general demoralization.
- Bill Toulas
- March 02, 2022
- 06:46 PM
- 1
WordPress force installs UpdraftPlus patch on 3 million sites

WordPress has taken the rare step of force-updating the UpdraftPlus plugin on all sites to fix a high-severity vulnerability allowing website subscribers to download the latest database backups, which often contain credentials and PII.
- Bill Toulas
- February 18, 2022
- 11:19 AM
- 0
PHP Everywhere RCE flaws threaten thousands of WordPress sites

Researchers found three critical remote code execution (RCE) vulnerabilities in the PHP Everywhere plugin for WordPress, used by over 30,000 websites worldwide.
- Bill Toulas
- February 09, 2022
- 04:33 PM
- 0
600K WordPress sites impacted by critical plugin RCE vulnerability

Essential Addons for Elementor, a popular WordPress plugin used in over a million sites, has been found to have a critical remote code execution (RCE) vulnerability in version 5.0.4 and older.
- Bill Toulas
- January 31, 2022
- 03:35 PM
- 2
Chaes banking trojan hijacks Chrome with malicious extensions

A large-scale campaign involving over 800 compromised WordPress websites is spreading banking trojans that target the credentials of Brazilian e-banking users.
- Bill Toulas
- January 26, 2022
- 11:39 AM
- 0
Over 90 WordPress themes, plugins backdoored in supply chain attack

A massive supply chain attack compromised 93 WordPress themes and plugins to contain a backdoor, giving threat-actors full access to websites.
- Bill Toulas
- January 21, 2022
- 10:34 AM
- 0
WordPress plugin flaw puts users of 20,000 sites at phishing risk

The WordPress WP HTML Mail plugin, installed in over 20,000 sites, is vulnerable to a high-severity flaw that can lead to code injection and the distribution of convincing phishing emails.
- Bill Toulas
- January 20, 2022
- 10:50 AM
- 0
WordPress 5.8.3 security update fixes SQL injection, XSS flaws

The WordPress development team released version 5.8.3, a short-cycle security release that addresses four vulnerabilities, three of which are rated of high importance.
- Bill Toulas
- January 10, 2022
- 10:28 AM
- 0
800K WordPress sites still impacted by critical SEO plugin flaw

Two critical and high severity security vulnerabilities in the highly popular "All in One" SEO WordPress plugin exposed over 3 million websites to takeover attacks.
- Sergiu Gatlan
- December 21, 2021
- 02:25 PM
- 1
Massive attack against 1.6 million WordPress sites underway

Wordfence analysts report having detected a massive wave of attacks in the last couple of days, originating from 16,000 IPs and targeting over 1.6 million WordPress sites.
- Bill Toulas
- December 10, 2021
- 03:29 AM
- 0
Hackers infect random WordPress plugins to steal credit cards

Credit card swipers are being injected into random plugins of e-commerce WordPress sites, hiding from detection while stealing customer payment details.
- Bill Toulas
- December 08, 2021
- 01:11 PM
- 0
GoDaddy data breach hits WordPress hosting services resellers

GoDaddy says the recently disclosed data breach affecting roughly 1.2 million customers has also hit multiple Managed WordPress services resellers.
- Sergiu Gatlan
- November 24, 2021
- 10:47 AM
- 0
WordPress sites are being hacked in fake ransomware attacks

A new wave of attacks starting late last week has hacked close to 300 WordPress sites to display fake encryption notices, trying to trick the site owners into paying 0.1 bitcoin for restoration.
- Bill Toulas
- November 16, 2021
- 12:35 PM
- 0