Latest WordPress news

Ironic twist: WP Reset PRO bug lets hackers wipe WordPress sites

A high severity security flaw in the WP Reset PRO WordPress plugin can let authenticated attackers wipe vulnerable websites, as revealed by Patchstack security researchers.
- Sergiu Gatlan
- November 10, 2021
- 12:00 PM
- 0
WordPress plugin bug impacts 1M sites, allows malicious redirects

The OptinMonster plugin is affected by a high-severity flaw that allows unauthorized API access and sensitive information disclosure on roughly a million WordPress sites.
- Bill Toulas
- October 28, 2021
- 10:50 AM
- 0
Brutal WordPress plugin bug allows subscribers to wipe sites

A high severity security flaw found in a WordPress plugin with more than 8,000 active installs can let authenticated attackers reset and wipe vulnerable websites.
- Sergiu Gatlan
- October 26, 2021
- 03:19 PM
- 1
WordPress force installs Jetpack security update on 5 million sites

Automattic, the company behind the WordPress content management system, force deploys a security update on over five million websites running the Jetpack WordPress plug-in.
- Sergiu Gatlan
- June 03, 2021
- 03:00 PM
- 0
Critical WordPress plugin zero-day under active exploitation

Threat actors are scanning for sites running the Fancy Product Designer plug-in to exploit a zero-day bug allowing them to upload malware.
- Sergiu Gatlan
- June 01, 2021
- 01:25 PM
- 0
WordPress may automatically disable Google FLoC on websites

WordPress announced today that they are treating Google's new FLoC tracking technology as a security concern and may block it by default on WordPress sites.
- Lawrence Abrams
- April 18, 2021
- 03:12 PM
- 4
Zerodium triples WordPress remote code execution exploit payout

Zerodium has announced today an increased interest in exploits for the WordPress content management system that achieve remote code execution.
- Ionut Ilascu
- April 09, 2021
- 10:42 AM
- 0
Fake jQuery files infect WordPress sites with malware

Researchers have spotted counterfeit versions of the jQuery Migrate plugin injected on dozens of websites which contains obfuscated code to load malware. These files are named jquery-migrate.js & jquery-migrate.min.js and present at the exact locations where JavaScript files are normally present on WordPress sites but are malicious.
- Ax Sharma
- March 31, 2021
- 07:55 AM
- 1
Wordpress plans to drop support for Internet Explorer 11

The most well-known and popular blogging platform, WordPress, is considering dropping support for Internet Explorer 11 as the browser's usage dips below 1%.
- Lawrence Abrams
- March 09, 2021
- 12:14 PM
- 0
Buggy WordPress plugin exposes 100K sites to takeover attacks

Critical and high severity vulnerabilities in the Responsive Menu WordPress plugin exposed over 100,000 sites to takeover attacks as discovered by Wordfence.
- Sergiu Gatlan
- February 11, 2021
- 12:05 PM
- 0
Critical vulnerability fixed in WordPress plugin with 800K installs

The NextGen Gallery development team has addressed two severe CSRF vulnerabilities to protect sites from potential takeover attacks.
- Sergiu Gatlan
- February 08, 2021
- 03:05 PM
- 0
WordPress plugin with 5 million installs has a critical vulnerability

The team behind a popular WordPress plugin has disclosed a critical file upload vulnerability and issued a patch. The vulnerable plugin, Contact Form 7, has over 5 million active installations making this upgrade a necessity for WordPress site owners out there.
- Ax Sharma
- December 17, 2020
- 10:52 AM
- 0
Hackers are actively probing millions of WordPress sites

Unknown threat actors are scanning for WordPress websites with Epsilon Framework themes installed on over 150,000 sites and vulnerable to Function Injection attacks that could lead to full site takeovers.
- Sergiu Gatlan
- November 17, 2020
- 05:02 PM
- 1
WordPress plugin bugs can let attackers hijack up to 100K sites

Admins of WordPress sites who use the Ultimate Member plugin are urged to update it to the latest version to block attacks attempting to exploit multiple critical and easy to exploit vulnerabilities that could lead to site takeovers.
- Sergiu Gatlan
- November 09, 2020
- 06:29 PM
- 0
Hackers are fighting a war over 300K vulnerable WordPress sites

Attackers who are actively exploiting a critical remote code execution flaw affecting over 600,000 of WordPress sites running vulnerable File Manager plugin versions have also been seen protecting the sites they compromise from other threat actors' attacks.
- Sergiu Gatlan
- September 10, 2020
- 03:43 PM
- 0
Hackers actively exploiting severe bug in over 300K WordPress sites

Hackers are actively exploiting a critical remote code execution vulnerability allowing unauthenticated attackers to upload scripts and execute arbitrary code on WordPress sites running vulnerable File Manager plugin versions.
- Sergiu Gatlan
- September 02, 2020
- 09:27 AM
- 0
WordPress WooCommerce stores under attack, patch now

Hackers are actively targeting and trying to exploit SQL injection, authorization issues, and unauthenticated stored cross-site scripting (XSS) security vulnerabilities in the Discount Rules for WooCommerce WordPress plugin with more than 30,000 installations.
- Sergiu Gatlan
- August 21, 2020
- 03:30 PM
- 0
Facebook plugin bug lets hackers hijack WordPress sites’ chat

A high severity bug found in Facebook's official chat plugin for WordPress websites with over 80,000 active installations could allow attackers to intercept messages sent by visitors to the vulnerable sites' owner.
- Sergiu Gatlan
- August 04, 2020
- 04:09 PM
- 0
Newsletter plugin bugs let hackers inject backdoors on 300K sites

Owners of WordPress sites who use the Newsletter plugin are advised to update their installations to block attacks that could use a fixed vulnerability allowing hackers to inject backdoors, create rogue admins, and potentially take over their websites.
- Sergiu Gatlan
- August 03, 2020
- 03:36 PM
- 0
Critical Wordpress plugin bug lets hackers take over hosting account

Hackers can exploit a maximum severity vulnerability in the wpDiscuz plugin installed on over 70,000 WordPress sites to execute code remotely after uploading arbitrary files on servers hosting vulnerable sites.
- Sergiu Gatlan
- July 28, 2020
- 06:59 PM
- 0