Latest Updates and Insights on WordPress Security

---

Critical WordPress Plugin Flaws Put Over 600,000 Websites at Risk of Takeover

Two critical vulnerabilities in The Events Calendar WordPress plugin could allow unauthenticated attackers to take over vulnerable websites. The flaws affect more than 600,000 active installations. They can lead to remote code execution, administrator password resets, malware deployment, and full server compromise. Wordfence Argus, developed by the Wordfence Threat Intelligence team, discovered the two independent […] The post Critical WordPress Plugin Flaws Put Over 600,000 Websites at Risk of Takeover appeared first on Cyber Security News.

---

WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution

WordPress has announced it's launching an automated security review for every release of a plugin before it's distributed through the WordPress.org update API so as to analyze it for potential security issues and ensure there are no risks involved. "New plugins are reviewed before they enter the directory, but updates ship continuously after that," David Perez, WordPress Official Plugin

---

WordPress Uses AI to Stop Malicious Plugin Updates Before They Reach Millions of Websites

WordPress has rolled out an automated, AI-driven security review that screens every plugin release before it reaches the WordPress.org update API, adding a critical checkpoint to a distribution pipeline that had previously lacked one. The move follows a real-world incident in which a backdoor was slipped into an update for a plugin with roughly 20,000 […] The post WordPress Uses AI to Stop Malicious Plugin Updates Before They Reach Millions of Websites appeared first on Cyber Security News.

---

WordPress Plugin Flaw Exposes 5 Million Sites to SQL Injection Attacks

A high-severity vulnerability in the All-in-One WP Migration and Backup plugin could allow unauthenticated attackers to take over vulnerable WordPress sites. The flaw, tracked as CVE-2026-19949, affects more than 5 million active installations and has been fixed in version 7.110. The issue was reported to Wordfence on August 14, 2026, by security researcher Jack Taylor […] The post WordPress Plugin Flaw Exposes 5 Million Sites to SQL Injection Attacks appeared first on Cyber Security News.

---

WordPress Is Using AI to Find Security Flaws Before Hackers Can Exploit Them

WordPress has launched a new security effort that uses artificial intelligence to identify vulnerabilities in its core software before attackers can abuse them. The initiative comes as the project receives an increasing number of security reports, driven in part by rapid improvements in AI tools for code analysis and vulnerability research. Over the past year, […] The post WordPress Is Using AI to Find Security Flaws Before Hackers Can Exploit Them appeared first on Cyber Security News.

---

Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE

Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, that could lead to authentication bypass, account takeover, and arbitrary code execution. The vulnerabilities, according to Wordfence and Patchstack, are listed below - CVE-2026-76581 (CVSS score: 9.8) - An authentication bypass flaw in

---

Hackers Compromise Hundreds of WordPress Sites to Deploy Amatera Stealer via ClickFix

A fake student resume is being used to place a remote-access tool on researchers’ Windows computers. The campaign hides a Windows executable inside an archive that appears to contain a graduate-school application, then opens a genuine Word document while the infection runs quietly in the background. The lure claims to come from a recent Beijing […] The post Hackers Compromise Hundreds of WordPress Sites to Deploy Amatera Stealer via ClickFix appeared first on Cyber Security News.

---

Hackers Exploit ownCloud and WordPress Flaws to Steal Philippine Nuclear and Naval Data

A suspected Chinese-speaking operator exploited known ownCloud and WordPress weaknesses to collect sensitive information from a Philippine nuclear research body and a marine engineering company that serves the Philippine Navy. The intrusion shows how unpatched internet-facing systems can expose data with national-security value. The activity came to light after investigators found an openly accessible server […] The post Hackers Exploit ownCloud and WordPress Flaws to Steal Philippine Nuclear and Naval Data appeared first on Cyber Security News.

---

WordPress Plugin Vulnerability Exposes 400,000 Sites to Account Takeover Attacks

A critical vulnerability in the TranslatePress WordPress plugin could allow unauthenticated attackers to hijack administrator accounts and fully compromise affected websites. The flaw, tracked as CVE-2026-19632, affects TranslatePress versions up to 3.3.1 and has been fixed in version 3.3.2. TranslatePress is a multilingual WordPress plugin with more than 400,000 active installations. Wordfence assigned the vulnerability […] The post WordPress Plugin Vulnerability Exposes 400,000 Sites to Account Takeover Attacks appeared first on Cyber Security News.

---

Hackers Exploit Critical miniOrange SAML SSO Flaws to Hijack WordPress Admin Accounts

Two critical flaws in the miniOrange SAML 2.0 Single Sign-On plugin could allow unauthenticated attackers to log in to vulnerable WordPress sites as any existing user, including administrators. The flaws, tracked as CVE-2026-61979 and CVE-2026-15981, carry a CVSS score of 9.8 and have been linked to attempted exploitation activity in the wild. The vulnerabilities affect […] The post Hackers Exploit Critical miniOrange SAML SSO Flaws to Hijack WordPress Admin Accounts appeared first on Cyber Security News.

---

Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access

Bad actors are attempting to exploit two severe unauthenticated authentication bypasses in the Xecurify miniOrange SAML 2.0 Single Sign On plugin that make it possible for an attacker to sign in as any WordPress user, including administrators. The vulnerabilities, as disclosed by Patchstack, are listed below - CVE-2026-61979 (CVSS score: 8.1) - An unauthenticated privilege escalation

---

WordPress Plugin Vulnerability Exposes 100,000 Sites to Complete Site Takeover Attacks

A critical vulnerability tracked as CVE-2026-19598 in the Everest Forms WordPress plugin has exposed more than 100,000 websites to complete site takeover attacks. The flaw has a CVSS severity score of 9.8. It can allow unauthenticated attackers to upload malicious files, execute code remotely, and potentially gain full control of affected WordPress sites. The vulnerability […] The post WordPress Plugin Vulnerability Exposes 100,000 Sites to Complete Site Takeover Attacks appeared first on Cyber Security News.

---

Critical WordPress Plugin Vulnerability Exposes Sites to RCE Attacks

A critical security flaw in the Elementor Pro WordPress plugin could allow unauthenticated attackers to upload malicious PHP files and execute code on vulnerable servers. Tracked as CVE-2026-32475, the vulnerability affects Elementor Pro versions up to and including 4.2.1 and is fixed in version 4.2.2. Elementor Pro is a premium extension for the Elementor page […] The post Critical WordPress Plugin Vulnerability Exposes Sites to RCE Attacks appeared first on Cyber Security News.

---

StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal Data

Cybersecurity researchers have flagged a global cybercrime operation that abuses thousands of hacked WordPress websites as infrastructure to disseminate malware, commandeer infected hosts, store stolen documents, screenshots, and activity logs created to track the status of the activity. "The operation doesn't rely on a single piece of malware, but on a whole toolkit of criminal software

---

Hackers Hijack Thousands of WordPress Sites to Use as C2 Servers for StopAndProtect Malware

A newly uncovered malware operation dubbed StopAndProtect is transforming thousands of hacked WordPress websites into a sprawling criminal command-and-control (C2) infrastructure. The campaign blends double-extortion ransomware with covert data theft, quietly harvesting sensitive corporate documents, system screenshots, user credentials, and active communication logs from compromised machines worldwide. Internal logs exposed through the threat actors’ operational […] The post Hackers Hijack Thousands of WordPress Sites to Use as C2 Servers for StopAndProtect Malware appeared first on Cyber Security News.

---

Critical WordPress Plugin Vulnerability Exposes 600,000 Sites to File Upload Attacks

A critical security flaw in the Forminator Forms WordPress plugin could allow unauthenticated attackers to upload malicious PHP files, potentially enabling them to take full control of vulnerable websites. The issue, tracked as CVE-2026-15748, affects Forminator Forms versions 1.56.1 and earlier and carries a CVSS severity score of 9.8. Forminator Forms is a widely used […] The post Critical WordPress Plugin Vulnerability Exposes 600,000 Sites to File Upload Attacks appeared first on Cyber Security News.

---

Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads

A critical security flaw has been disclosed in Forminator Forms, a WordPress plugin with more than 600,000 active installations, that could be exploited to achieve arbitrary code execution on susceptible sites. The vulnerability, tracked as CVE-2026-15748, is rated 9.8 out of 10.0 on the CVSS scoring system. It was discovered and reported by a security researcher who goes by the online alias "

---

WordPress Imagick RCE Vulnerability Allows Authors to Execute Code via Malicious PNG File

WordPress has released version 7.0.4, a security-focused update that closes a remote code execution vulnerability affecting sites that process images with the Imagick extension and Ghostscript. The WordPress security team is urging site owners to update immediately, either through the Dashboard’s Updates screen or by downloading the release directly from WordPress.org, since sites with automatic […] The post WordPress Imagick RCE Vulnerability Allows Authors to Execute Code via Malicious PNG File appeared first on Cyber Security News.

---

WordPress 7.0.4 Release

WordPress 7.0.4 is now available WordPress 7.0.4 is now available which features a security fix. Because this is a security release, it is recommended that you update your sites immediately. You can update to WordPress 7.0.4 by downloading it from WordPress.org, or visiting your site’s Dashboard → Updates and clicking Update Now. Sites that support […]

---

BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins

Cybersecurity researchers have warned of a supply chain compromise impacting WordPress plugin vendor BdThemes, prompting the content management systems (CMS) platform's plugins team to temporarily disable their downloads. "Unlike traditional software supply chain attacks, zero source code files were modified within the official WordPress.org repository," Wordfence researcher Paolo Tresso said.