Latest Updates and Insights on WordPress Security

---

Installing the Fix for an Exploited WordPress Flaw Can Expose Some Sites One Last Time

Some WordPress sites can still be attacked while they install the fix for an actively exploited flaw, according to Umut Bayram, the Picus Security researcher who found it. The update that installs the fix still unpacks its files using the site's old, unpatched code, so an attacker who strikes at the right moment can run code on the server. The researcher advises blocking web access to the

---

Hackers Launch 240,000 Exploit Attempts WordPress Core Flaw Enabling Remote Code Execution

Hackers have launched more than 240,000 exploit attempts against a WordPress Core vulnerability that can allow attackers to run malicious code without logging in. According to the supplied Wordfence report, attacks began on October 28, 2026, the same day WordPress released a security update addressing the flaw. Tracked as CVE-2026-119977, the vulnerability carries a high […] The post Hackers Launch 240,000 Exploit Attempts WordPress Core Flaw Enabling Remote Code Execution appeared first on Cyber Security News.

---

CISA Warns of WordPress Core Vulnerability Exploited in Attacks to Execute Malicious Code

The U.S. Cybersecurity and Infrastructure Security Agency has warned that attackers are exploiting a WordPress Core vulnerability that can allow malicious code to run on website servers. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 3, 2026, confirming evidence of active exploitation and raising the need for prompt patching. Tracked as […] The post CISA Warns of WordPress Core Vulnerability Exploited in Attacks to Execute Malicious Code appeared first on Cyber Security News.

---

CISA Confirms Hackers Exploiting WordPress Core Flaw During Software Upgrades

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a security flaw in WordPress Core to the Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The high-severity vulnerability, tracked as CVE-2026-119977 (CVSS score: 8.1), is a case of Time-of-check Time-of-use (TOCTOU) race condition that could be exploited to achieve arbitrary code

---

Over 60,000 Attacks Target WordPress RCE Vulnerability Within 24 Hours

Hackers are targeting a WordPress Core remote code execution vulnerability that can expose websites during software updates. The supplied Wordfence threat intelligence snapshot lists 60,471 blocked attempts over 24 hours. These are attack attempts, not confirmed website compromises, and the figure does not establish how many individual sites were targeted. WordPress released version 7.1.4 on […] The post Over 60,000 Attacks Target WordPress RCE Vulnerability Within 24 Hours appeared first on Cyber Security News.

---

WordPress RCE Flaw Draws Nearly 63,000 Attack Attempts in Just 24 Hours

Threat actors have been observed attempting to exploit a high-severity security flaw in WordPress Core shortly after patches were released. The vulnerability, which does not have a CVE identifier, relates to a case of remote code execution impacting WordPress Core versions 4.7 through 7.1.3. It carries a CVSS score of 8.1 on the CVSS scoring system. Patches for the flaw were released on October

---

Hackers Actively Exploiting WordPress Remote Code Execution Flaw Just Hours After Patch Release

A WordPress remote code execution vulnerability came under attack just hours after version 7.1.4 was released on October 28, 2026, fixing 22 vulnerabilities, including an unauthenticated code execution flaw in the update process. Site owners should verify that the patch is installed. According to Wordfence’s supplied threat report, its firewall recorded more than 18,500 requests […] The post Hackers Actively Exploiting WordPress Remote Code Execution Flaw Just Hours After Patch Release appeared first on Cyber Security News.

---

WordPress 7.1.4 Fixes 22 Security Flaws, Including an Unauthenticated RCE Vulnerability

WordPress released version 7.1.4 on October 28, 2026, fixing 22 security flaws, including an unauthenticated remote code execution vulnerability in its update process. The security release also addresses stored cross-site scripting, data exposure, and access control issues. WordPress urges website owners to install the update immediately. The official release announcement credits security researcher Umut Bayram […] The post WordPress 7.1.4 Fixes 22 Security Flaws, Including an Unauthenticated RCE Vulnerability appeared first on Cyber Security News.

---

WordPress 7.1.4

This security release features fixes for multiple issues. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.4 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will […]

---

Hackers Can Abuse Logged-In WordPress Admin Sessions to Secretly Install PHP Backdoors

WordPress administrators often keep their dashboard open in the same browser they use for everyday browsing. A new attack chain shows why that habit is risky. Researchers have documented a JavaScript loader that waits for a signed-in administrator to visit a compromised page, then uses that browser’s trusted session to install a hidden PHP backdoor […] The post Hackers Can Abuse Logged-In WordPress Admin Sessions to Secretly Install PHP Backdoors appeared first on Cyber Security News.

---

Critical PHP Security Release

The PHP project has announced a security release that fixes two critical security vulnerabilities discovered in PHP. Due to the critical severity of the issues, site owners are encouraged to immediately update their installations of PHP. Your web host may already be working to update PHP and put web application firewall (WAF) rules in place […]

---

Attackers Abuse UpdraftCentral Keys to Plant Backdoors on WordPress Sites

Unknown threat actors breached TeamUpdraft's website and potentially gained unauthorized access to customers' connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, using them to backdoor WordPress sites. TeamUpdraft is the developer behind UpdraftPlus, a popular WordPress backup plugin with over four million active installations. The vendor also offers UpdraftCentral, a remote

---

WordPress Backup Plugin Developer Hacked to Inject Malicious Code on Installed Sites

TeamUpdraft, the developer behind the UpdraftPlus WordPress backup plugin, has disclosed a website breach that exposed remote management keys. Attackers used those keys to install malicious plugins on connected WordPress sites, turning a trusted management feature into a route for running harmful code. The company identified unauthorized access to teamupdraft.com during October 17–18, 2026. Attackers […] The post WordPress Backup Plugin Developer Hacked to Inject Malicious Code on Installed Sites appeared first on Cyber Security News.

---

WP2Shell Attack Lets Hackers Create WordPress Admin Accounts and Install Web Shells Without Login

WP2Shell combines two WordPress Core flaws to move from an unauthenticated request to server-side code execution. It can let an attacker create an administrator account and install a plugin-based web shell. Seqrite’s October 16 analysis lists affected releases, but does not establish widespread live exploitation. The report says the flaws were disclosed in July 2026. […] The post WP2Shell Attack Lets Hackers Create WordPress Admin Accounts and Install Web Shells Without Login appeared first on Cyber Security News.

---

Hackers Compromise Rank Math PRO WordPress Plugin to Install Self-Rebuilding Backdoors

Hackers planted malware in copies of the Rank Math PRO WordPress plugin, exposing websites to hidden backdoors that can rebuild themselves after removal. Rank Math confirmed that some version 3.0.123 packages distributed during a limited October download window contained malicious code that could compromise websites when activated. The company removed the affected files and released […] The post Hackers Compromise Rank Math PRO WordPress Plugin to Install Self-Rebuilding Backdoors appeared first on Cyber Security News.

---

Popular WordPress SEO Plugin Rank Math PRO Hijacked to Deliver Self-Restoring Backdoor

Copies of Rank Math PRO, the paid version of the Rank Math SEO plugin for WordPress, that were downloaded from rankmath.com or delivered as updates between 20:02 UTC on October 15 and 07:12 UTC on October 16 contained malware, Rank Math said in a security notice published on October 16. Any site that installed and activated one of those copies should be treated as compromised, and the

---

WordPress Plugin Vulnerability Exploited in Attacks to Upload and eEecute Arbitrary PHP code

Attackers are targeting a critical security flaw in the Bricksforge WordPress plugin that lets them upload and run arbitrary PHP code without logging in. Tracked as CVE-2026-85097, the vulnerability carries a maximum CVSS score of 10.0 and can lead to remote code execution on affected websites. Patchstack first observed exploitation attempts on October 7, 2026, […] The post WordPress Plugin Vulnerability Exploited in Attacks to Upload and eEecute Arbitrary PHP code appeared first on Cyber Security News.

---

Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE

A maximum-severity security flaw impacting the Bricksforge plugin for WordPress has come under active exploitation in the wild, according to Patchstack. The critical vulnerability in question is CVE-2026-85097 (CVSS score: 10.0), which allows unauthenticated attackers to upload and execute arbitrary PHP code on vulnerable WordPress websites, resulting in remote code execution (RCE). The

---

Critical WordPress Vulnerabilities Enable XSS, SQL Injection and Data Disclosure Attacks

WordPress released version 7.1.3 on October 6, 2026, addressing vulnerabilities involving cross-site scripting, SQL injection, information disclosure, and other security weaknesses. The project recommends immediate updates, with fixes also available for older affected branches. Only the latest WordPress version remains actively supported. The release documentation lists seven security issues, although its introductory sentence describes “one […] The post Critical WordPress Vulnerabilities Enable XSS, SQL Injection and Data Disclosure Attacks appeared first on Cyber Security News.

---

WordPress 7.1.3 Maintenance and Security Release

This security and maintenance release features 7 security fixes and 4 bug fixes. Because this is a security release, it is recommended that you update your sites immediately. You can download WordPress 7.1.3 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background […]