Rank Math PRO WordPress Plugin Compromised in Supply-Chain Attack
The Rank Math PRO WordPress plugin was compromised via its official vendor site, distributing malware with hidden backdoors that affect numerous websites.
Tag
#WordPress
13 results in the archive.
Critical Bricksforge WordPress Flaw Enables Unauthenticated RCE Exploited
A critical unauthenticated remote code execution vulnerability in the Bricksforge WordPress plugin is actively exploited, affecting vulnerable WordPress sites.
WordPress Backdoor Rebuilds Itself Using Files, Database, and Shared Memory
Researchers uncovered a WordPress backdoor named SC that self-heals using multiple persistence methods, complicating removal efforts and increasing ongoing risks.
Elementor WordPress CSRF Flaw Allows Admin Account Creation
A CSRF flaw in Elementor Website Builder versions 4.3.0 and 4.3.1 can let an attacker induce a logged-in WordPress administrator to create an attacker-controlled admin account. Version 4.3.2 fixes the issue.
WordPress Patches Critical Flaw Allowing Remote Code Execution
WordPress released a patch for a critical vulnerability that allowed unauthenticated attackers to load PHP files externally, risking remote code execution on affected servers.
Critical Elementor Pro Flaw Enables Takeover of WordPress Sites
A critical vulnerability (CVE-2026-32475) in Elementor Pro is actively exploited to deliver webshells and execute commands on WordPress servers.
GiveWP WordPress Plugin Flaw Lets Hackers Execute Server Commands
A critical vulnerability in the GiveWP donation plugin for WordPress allows unauthenticated attackers to execute arbitrary commands on the hosting server.
Critical Avada WordPress Theme Flaw Enables Zero-Click Remote Code Execution
A critical zero-click remote code execution vulnerability in the Avada WordPress theme allows unauthenticated attackers to execute arbitrary PHP code on affected servers.
StopAndProtect Uses 2,000 Hacked WordPress Sites to Spread Malware
The StopAndProtect campaign uses nearly 2,000 compromised WordPress sites worldwide to distribute malware and collect stolen data, impacting web infrastructure security.
WordPress Core SQL Injection Vulnerability CVE-2026-63030 Exploited
A critical SQL injection vulnerability identified as CVE-2026-63030 affects WordPress Core and is actively exploited, allowing unauthenticated remote code execution.
Critical wp2shell WordPress Flaw Allows Unauthenticated Code Execution
A critical vulnerability in WordPress core enables unauthenticated attackers to execute code on default installations, prompting urgent patch releases.
Exposed Server Reveals WP-SHELLSTORM Backdoor Targeting 1.4M WordPress Sites
A hacker group's exposed server revealed tools, logs, and a target list of over 1.4 million WordPress sites, exposing a large-scale WordPress backdoor campaign.
ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack
Attackers compromised ShapedPlugin's build pipeline to inject backdoor code into Pro plugins via official update channels. This supply chain attack puts thousands of WordPress sites at risk of remote exploitation.