WordPress

Cybersecurity researchers disclosed a critical flaw in the Elementor Pro WordPress plugin that could allow unauthenticated attackers to upload PHP and execute code. The vulnerability, designated CVE-2026-32475, has a CVSS score of 9.0 out of 10.0 and involves an unrestricted file upload mechanism within the Forms module.

Cybersecurity researchers flagged a global cybercrime operation that abuses thousands of hacked WordPress websites. This infrastructure is used to spread malware and steal data, commandeering infected hosts. The criminals store stolen documents, screenshots, and activity logs using an entire toolkit of criminal software.

A supply chain compromise impacted WordPress plugin vendor BdThemes, leading the CMS platform's plugins team to temporarily disable their downloads. Cybersecurity researchers issued warnings regarding this issue. However, they noted that zero source code files were modified within the official WordPress.org repository.

WordPress patched a critical core vulnerability chain called wp2shell, which allows attackers to gain full control of sites without authentication, leading to risks like credential theft, malware delivery, and malicious redirects for visitors. Attackers have already begun exploiting the flaw, injecting harmful content and compromising user trust.

Attackers are exploiting two critical WordPress vulnerabilities, CVE-2026-63030 and CVE-2026-60137, codenamed wp2shell, to achieve unauthenticated remote code execution and fully compromise vulnerable websites. The exploitation has led to increased mass scanning of WordPress sites.

Attackers are exploiting two critical WordPress vulnerabilities (CVE-2026-63030 and CVE-2026-60137) to enable pre-authentication remote code execution. The flaws, patched in WordPress versions 6.9.5 and 7.1 Beta 2, allow unauthenticated users to execute arbitrary code by chaining an SQL injection issue with a REST API route confusion bug. Security researchers observed widespread exploitation within hours of the patches being released.

A new vulnerability called 'WP2Shell' has been discovered in WordPress, allowing remote takeover. Attackers are actively exploiting CVE-2026-60137 and CVE-2026-63030 to target millions of sites.

This week's security vulnerabilities include WordPress Remote Code Execution, SonicWall 0-Days, AI service attacks, and a SharePoint 0-Day, leading to code execution, memory loss, stolen keys, and disabled security tools. The issues stemmed from exposed systems, weak checks, old drivers, fake prompts, and public code used for malware delivery.

A new WordPress core vulnerability named wp2shell allows unauthenticated attackers to execute arbitrary code via an anonymous HTTP request. The flaw exists in the core software, making even installations with no plugins exploitable. WordPress released updates 6.9.5 and 7.0.2 to address the issue, which previously affected all 6.9 and 7.0 versions.

US Army websites oil.army.mil and ai2c.army.mil were defaced with pro-Kurdish messages and insults targeting President Donald Trump and Ambassador Tom Barrack. The defacements, achieved via 404 hijacking, affected error pages on subdomains hosted on WordPress and Microsoft cloud infrastructure. The Army took the sites offline, stating they were hosted on a legacy third-party platform unrelated to its enterprise network.

Hackers are exploiting a patched security flaw in the Gravity SMTP WordPress plugin, affecting approximately 100,000 sites. The vulnerability, CVE-2026-4020, is a medium-severity information disclosure flaw allowing unauthenticated attackers to extract sensitive data like API keys and OAuth tokens.

Hackers are exploiting an unauthenticated information disclosure vulnerability in the Gravity SMTP WordPress plugin, which is active on 100,000 sites. The vulnerability allows threat actors to access sensitive data without authentication.

An unknown threat actor is using fake reviews, AI narrators, and VirusTotal comments to promote malicious software through phishing pages, GitHub, and SourceForge projects, according to Check Point Research.

Hackers are actively exploiting a critical vulnerability (CVE-2026-3300) in the Everest Forms Pro plugin, allowing them to take complete control of WordPress websites.

Threat actors are exploiting a critical remote code execution vulnerability (CVE-2026-3300) in Everest Forms Pro, a WordPress plugin with 4,000 active installations, leading to site compromises. The vulnerability affects all versions up to 1.9.12.

WordPress's market share has declined to 41.9% from 43.2% over six months, according to W3Techs data. The drop coincides with ongoing disputes between Automattic and WP Engine, including lawsuits and public conflicts, while competitors like Wix and Shopify show gains.

Hackers are exploiting a critical privilege escalation vulnerability (CVE-2026-8206) in the Kirki plugin for WordPress to take over any user account, including administrators. The flaw allows unauthorized access to WordPress admin accounts through the Kirki plugin.

Nearly 2,000 WordPress websites were infected with malware that uses Steam Community profile comments to hide command-and-control data. The campaign involves hiding malicious payloads in Steam profiles to communicate with compromised sites.

Hackers are exploiting a vulnerability in the WP Maps Pro plugin to create unauthorized administrator accounts on WordPress websites. The exploit allows attackers to bypass authentication and gain administrative access.

A critical security vulnerability in the Funnel Builder plugin for WordPress is being actively exploited to steal payment data from WooCommerce checkout pages. The vulnerability allows malicious JavaScript code to be injected into these pages. Details of the activity were published by Sansec.

A critical vulnerability in the Funnel Builder plugin for WordPress is being exploited to inject malicious JavaScript into WooCommerce checkout pages, potentially stealing credit card information. The bug is actively being used by attackers, putting users' sensitive data at risk. The issue highlights the importance of keeping WordPress plugins up-to-date.

The Avada Builder plugin for WordPress has two vulnerabilities that allow hackers to read arbitrary files and extract sensitive information from the database, affecting an estimated one million active installations. This poses a significant risk to site credential theft. The vulnerabilities enable unauthorized access to sensitive data.

Hackers are exploiting a critical authentication bypass vulnerability in the Burst Statistics WordPress plugin to gain admin-level access to websites. The flaw allows attackers to bypass authentication and take control of vulnerable sites. This vulnerability poses a significant risk to website security.

The author, Yusuf Aytaş, reflects on ending a 20-year relationship with WordPress, citing dissatisfaction with its direction and complexity. They transition to a static site generator for greater control and simplicity, highlighting the platform's evolution and the growing preference for minimalistic tools in web development.

The Quick Page/Post Redirect WordPress plugin, used by over 70,000 sites, contained a hidden backdoor added five years ago that enabled attackers to inject arbitrary code into users' websites.

WordPress is now fully operational on-chain via the Internet Computer, utilizing PHP 8.5 and WASQL. This development highlights advancements in blockchain-based hosting and decentralized web technologies.

Hackers are exploiting a critical vulnerability in the Breeze Cache WordPress plugin that allows unauthorized arbitrary file uploads to servers. The flaw, which requires no authentication, is being actively used to compromise WordPress sites.

Aliens.gov is being operated as a WordPress multisite platform. The article, hosted at https://aliens.gov/, has 23 points and 24 comments on Hacker News (https://news.ycombinator.com/item?id=47828149).

Matt Mullenweg, co-founder of WordPress, overruled core committers to include Akismet on WordPress 7.0's connectors list. The decision sparked debate among developers about governance and plugin prioritization.

A WordPress plugin suite called EssentialPlugin was hacked, compromising over 30 plugins and injecting malware into thousands of websites. The malicious code grants unauthorized access to affected sites, posing a significant security risk.

Dozens of WordPress plugins were compromised to distribute malware after being sold to a new corporate owner. The attack affected thousands of websites using these plugins.

A person purchased 30 WordPress plugins and embedded backdoors into all of them, creating a significant security risk for users. The malicious plugins could allow unauthorized access to websites using the affected WordPress platforms.

Cloudflare has launched EmDash, an open-source system designed to address WordPress's limitations by integrating AI agents. The project, in early access, has sparked debate within the WordPress community, with founder Matt Mullenweg disputing Cloudflare's claims of being a 'spiritual successor' to WordPress.

Unknown threat actors compromised the update system for the Smart Slider 3 Pro plugin for WordPress and Joomla, distributing a backdoored version (3.5.1.35) via hijacked Nextend Servers. Patchstack, a WordPress security company, reported the incident, which affects a plugin with over 800,000 active installations.

The article discusses a company's transition from WordPress to Jekyll and static site generators, highlighting the use of Claude Code for rebuilding their website. It mentions the technical benefits and process of migrating to a static site generator.

Hackers hijacked the update system for the Smart Slider 3 Pro plugin, distributing malicious versions of WordPress and Joomla with multiple backdoors. The attack compromised the update process, allowing unauthorized access and potential data breaches.

A critical vulnerability in the Ninja Forms File Uploads premium add-on for WordPress allows unauthenticated arbitrary file uploads, enabling remote code execution. The flaw poses a significant security risk to WordPress users.