De multiples vulnérabilités ont été découvertes dans WordPress. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.
WordPress FR
Malicious versions of the Admin Menu Editor Pro plugin for WordPress have been distributed to more than 200 customers after a threat actor compromised the maintainer's website and pushed updates that created a hidden user account. [...]
Hackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture premium plugin for WordPress to upload a PHP backdoor. [...]
EPSS 0.02 CVE-2026-27540 WordPress WooCommerce Wholesale Lead Capture US
Rilevate quattro vulnerabilità, di cui due con gravità “alta”, in Design Scuole Italia, noto tema WordPress destinato alla realizzazione dei siti istituzionali delle scuole italiane. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di leggere file arbitrari sul filesystem, eludere i meccanismi di autenticazione ed accedere a informazioni sensibili sui sistemi interessati
EPSS 0.00 CVE-2026-87791 CVE-2026-87792 CVE-2026-87793 CVE-2026-89307 WordPress Design Scuole Italia školství IT
A recently patched critical vulnerability (CVE-2026-32475) in the Elementor Pro plugin for WordPress is being exploited in attacks that deliver a webshell payload and execute arbitrary commands on the server. [...]
EPSS 0.02 CVE-2026-32475 WordPress Elementor US
An SQL injection vulnerability in the All-in-One WP Migration and Backup plugin for WordPress could allow unauthenticated attackers to execute remote code and take control of affected websites. [...]
EPSS 0.01 CVE-2026-19949 WordPress All-in-One WP Migration and Backup US
Classification: Critical, Solution: Official Fix, Exploit Maturity: Not Defined, CVSSv3.1: 10.0, CVEs: CVE-2026-76581, CVE-2026-18431, CVE-2026-19632, CVE-2026-19598, CVE-2026-82222, Summary: Multiple critical security flaws have been disclosed in WordPress plugins and themes, including WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, that could lead to authentication bypass, account takeover, and arbitrary code execution. The vulnerabilities, according to Wordfence and Patchstack,…
EPSS 0.03 CVSS 10.0 CVE-2026-18431 CVE-2026-19598 CVE-2026-19632 CVE-2026-76581 CVE-2026-82222 WordPress WPMU DEV Avada TranslatePress FI
A maximum-severity vulnerability in the GiveWP plugin for WordPress allows an unauthenticated attacker to execute arbitrary commands on the hosting server. [...]
EPSS 0.02 CVE-2026-82222 WordPress GiveWP US
A critical vulnerability chain in the popular Avada theme for WordPress can be exploited by an unauthenticated attacker to execute arbitrary PHP code on the server. [...]
EPSS 0.01 CVE-2026-18431 WordPress Avada US
Classification: Severe, Solution: Official Fix, Exploit Maturity: Proof-of-Concept, CVSSv3.1: 9.8, CVEs: CVE-2026-61979, CVE-2026-15981, Summary: The two vulnerabilities observed in exploitation attempts are tracked as CVE-2026-61979 and CVE-2026-15981 and can be chained together to bypass authentication. Because the miniOrange SAML SSO plugin accepts the signature algorithm from incoming SAML responses instead of enforcing the configured one, an attacker can leverage CVE-2026-61979 to select…
EPSS 0.01 CVSS 9.8 CVE-2026-15981 CVE-2026-61979 WordPress miniOrange FI US
Rilasciati aggiornamenti di sicurezza che sanano una vulnerabilità, con gravità “critica”, presente nel plugin Pods per WordPress. Tale vulnerabilità, qualora sfruttata, potrebbe permettere a un utente non autenticato di ottenere privilegi elevati sul sistema interessato, compreso l'accesso amministrativo e la modifica delle password degli utenti.
EPSS 0.03 CVE-2026-19598 WordPress IT
Bezpečnostní výzkumníci upozornili na dvě kritické zranitelnosti v populárních pluginech pro WordPress. CVE-2026-15748 (CVSS 9,8) se týká pluginu Forminator Forms s více než 600 tisíci aktivními instalacemi. Neautentizovaný útočník může na zranitelný web nahrát škodlivý PHP soubor a za určitých podmínek dosáhnout vzdáleného spuštění kódu a úplného převzetí webu. Podmínkou zneužití je formulář obsahující současně pole File Upload a Select. Zranitelné jsou verze do 1.56.1 včetně, oprava je…
EPSS 0.05 CVSS 9.8 CVE-2026-15748 CVE-2026-15826 WordPress CZ
Research by: Jaromír Hořejší (@JaromirHorejsi) Key points StopAndProtect is a newly identified operation that combines file encryption with data theft. The criminals abuse thousands of hacked WordPress websites as their infrastructure – using them to spread the malware, control infected machines, and store stolen documents, screenshots, and activity logs (records created by malware to track its actions, progress, or status during execution). Operational security (OPSEC) failures by the…
WordPress IL
This wrap-up brings a full-on shell parade. Thirteen shiny new modules landed, starting with a buffet of RCEs. WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard, a Pix-for-WooCommerce, and for those who like their exploits closer to the bare-metal, the Fragnesia Linux kernel LPE (CVE-2026-46300). Metasploit also got the glow-up of the summer with the new http malleable profiles, MCP functionality and linux multi fetch payloads …
KEV ✓ · ransomware EPSS 0.97 CVE-2025-49132 CVE-2026-15409 CVE-2026-27760 CVE-2026-29053 CVE-2026-3891 CVE-2026-46300 CVE-2026-48907 CVE-2026-60137 CVE-2026-63030 WordPress Ghost CMS SonicWall Linux US
Upozorňujeme na dvojici zranitelností ve WordPress Core označovaných jako wp2shell (CVE-2026-63030 a CVE-2026-60137), které mohou při kombinovaném zneužití vést ke vzdálenému spuštění kódu (RCE) bez nutnosti přihlášení.
KEV ✓ EPSS 0.97 CVSS 9.0 CVE-2026-60137 CVE-2026-63030 WordPress CZ US AT FR
Sanata una vulnerabilità con gravità “alta” in WordPress. Tale vulnerabilità, qualora sfruttata, potrebbe consentire ad un utente malintenzionato remoto autenticato di eseguire codice arbitrario sui sistemi interessati.
EPSS 0.02 CVE-2026-65640 WordPress IT FR
Serial Number: AV26-792Date: August 10, 2026 As of August 7, 2026, WordPress is affected by a vulnerability in the following product: WordPress prior to 7.0.3 Open-source reporting indicates that CVE-2026-64638 is being exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available. WordPress 7.0.3 release – WordPress News
EPSS 0.31 CVE-2026-64638 WordPress CA RO
The fix for SQL injection is decades old and still works. So why did WordPress core just need an emergency patch for one? The data, and how to defend against it. Category: News
WordPress BE
CISA added CVE-2026-63030 to the Known Exploited Vulnerabilities catalog. Affected product: WordPress Core. Remediation due date: 2026-07-24.
KEV ✓ EPSS 0.97 CVE-2026-63030 WordPress US
CISA added CVE-2026-60137 to the Known Exploited Vulnerabilities catalog. Affected product: WordPress Core. Remediation due date: 2026-08-04.
KEV ✓ EPSS 0.78 CVE-2026-60137 WordPress US
For the latest discoveries in cyber research for the week of 20th July, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Ernst & Young, a global accounting and professional services company, has disclosed a data breach involving a compromised third-party IT support platform. The exposed support tickets may have contained client documents, tax information, employee details, and other sensitive information submitted while requesting technical assistance. Jscrambler, a…
KEV ✓ · ransomware EPSS 0.97 CVE-2026-15409 CVE-2026-15410 CVE-2026-56155 CVE-2026-56164 CVE-2026-60137 CVE-2026-63030 Microsoft WordPress SonicWall výroba a průmysl finance IL
WordPress core has an unauthenticated RCE (wp2shell), confirmed as SQL injection. Update to 7.0.2 or 6.9.5 now, with mitigations if you can't patch yet. Block the attack class at runtime with Aikido Zen. Category: Vulnerabilities & Threats
WordPress BE
Dnešní vydání našich Postřehů z bezpečnosti přináší informace o tom, jak malware řídil armádu WordPressů přes platformu Steam nebo jak se nechal omámit asistent Google Gemini. Dále si na Root.cz můžete přečíst o balíčcích Red Hatu kradoucí přístupové údaje a o českém projektu Phishguard Sentinel chránící internetové uživatele.
The BuddyBoss campaign (Parts 1 & 2) represents a full-spectrum software supply chain attack against the WordPress ecosystem, where the threat actor compromised the BuddyBoss plugin/theme distribution pipeline and leveraged it to infect hundreds of downstream websites. The ini...