A continuous intelligence feed of critical vulnerabilities, supply-chain takeovers, and platform decay affecting millions of WordPress websites—translated into plain English.
Real-world attack vectors, CVSS severity ratings, and plain-English operational impact assessments for WordPress operators.
A critical unauthenticated remote code execution vulnerability in the Bricks site builder theme allows remote attackers to execute arbitrary PHP code directly via eval() inside REST API element rendering.
A critical authorization missing check in FunnelKit Automations enables unauthenticated remote attackers to install and activate arbitrary plugins, leading to webshell deployment and site takeover.
A critical unauthenticated path traversal and local file inclusion vulnerability in the Kubio AI Page Builder plugin enables attackers to extract configuration secrets and achieve remote code execution.
A critical authentication bypass and privilege escalation flaw in OttoKit (formerly SureTriggers) enables unauthenticated attackers to silently create persistent administrator accounts.
A maximum-severity file upload vulnerability in Bricksforge enables unauthenticated attackers to bypass MIME validation using polyglot files and achieve full remote code execution.
A flawed Boolean comparison in miniOrange SAML SSO treats verification errors as successful logins, handing remote attackers instant administrator access.
A coordinated exploitation campaign targets Ninja Forms and WPC Product Bundles to inject stored XSS payloads that hijack administrator sessions, install persistent backdoor plugins, and create rogue admin accounts.
Insecure deserialization in ShortPixel Image Optimizer allows authenticated contributors to inject serialized gadget chains and achieve remote code execution.
A missing server-side validation check in Super Forms allows unauthenticated visitors submitting contact forms to upload PHP webshells and execute server commands.
An insecure deserialization flaw in Tutor LMS allows any open-registration student account to trigger PHP object injection and execute arbitrary server commands.
A critical flaw in WooCommerce Wholesale Lead Capture lets unauthenticated visitors upload executable PHP webshells directly into public directories.
A critical unauthenticated path traversal flaw in WordPress Core allows remote attackers to cross theme directory boundaries and include local PHP files, leading to remote code execution.
A directory traversal flaw in WordPress File Upload allows unauthenticated visitors to delete arbitrary server files and drop executable webshells.
A cryptographic signature validation defect in WPMU DEV Dashboard allows unauthenticated remote attackers to forge SSO tokens and seize full admin control.
An unsanitized URL parameter in Forminator Forms allows unauthenticated attackers to trigger arbitrary WordPress shortcode execution across the server.
A critical flaw in Gravity Forms allows unauthenticated attackers to bypass file extension restrictions through hidden upload fields and execute code on the server.
A path traversal vulnerability in WordPress core page template resolution allows unauthenticated attackers to execute arbitrary code on the hosting server.
A MIME-type blocklist bypass in the upload handler lets unauthenticated visitors upload PHP web shells through public intake and quote forms.
Two independent 9.8-severity chains let an unauthenticated commenter run server commands or reset the administrator password on 600,000+ event and calendar sites.
Two core flaws chained through the REST batch endpoint give an anonymous attacker remote code execution on a default WordPress install — no plugins required.
A critical privilege escalation vulnerability in Amelia Booking enables unauthenticated attackers to elevate account privileges and overwrite WordPress administrator credentials.
A critical local file inclusion vulnerability in Divi Ajax Filter allows unauthenticated attackers to include and execute arbitrary PHP files on the server.
A critical flaw in Hummingbird Performance allows unauthenticated attackers to inject executable PHP code into exposed debug logs, achieving full server takeover.
A critical authentication bypass in MStore API allows unauthenticated attackers to forge mobile login tokens and impersonate any WordPress user or administrator.
A critical access control vulnerability in Event Tickets and Registration allows unauthenticated attackers to overwrite merchant Stripe credentials, redirecting ticket sales into attacker-controlled accounts.
A critical vulnerability in Ninja Forms deserializes untrusted action configuration settings during cache compilation, exposing sites to remote PHP object injection and code execution.
An aggressive automated threat campaign is actively targeting unauthenticated arbitrary file upload endpoints in Super Forms and Elementor Pro to plant persistent PHP webshells.
A critical authentication bypass flaw in TranslatePress leaks plaintext administrator password-reset URLs to unauthenticated visitors during translation handling.
A dual-component authorization failure in the Avada theme and Fusion Builder plugin allows unauthenticated attackers to write arbitrary PHP files and achieve full server takeover.
A critical file-upload desynchronization vulnerability in Elementor Pro's premium Form Widget allows unauthenticated remote attackers to bypass extension filtering and achieve remote code execution.
A state validation flaw in Gravity Forms multi-file chunk handling allows unauthenticated attackers to write polyglot files to temporary directories, risking RCE on NGINX.
Missing permission validation on incoming AI Model Context Protocol endpoints allows unauthenticated actors to trigger administrative routines and take over accounts.
A second-order SQL injection flaw in All-in-One WP Migration and Backup allows unauthenticated attackers to harvest database secret keys during administrative restores.
A major file upload validation flaw in Elementor Pro allows unauthenticated attackers to bypass extension filtering and write webshell backdoors.
A critical PHP deserialization flaw in GiveWP allows automated bots to achieve remote code execution through standard donation forms without credentials.
A severe API validation hole in the Pods plugin lets unauthenticated visitors trigger admin password resets without email verification.
A flaw in Elementor Pro's dynamic template upload controls allows attackers to bypass extension filtering and deposit executable PHP backdoors.
WordPress core released an emergency security rollup addressing 12 distinct vulnerabilities across the login system, REST API, and media handlers.
A supply-chain compromise in the ARVE Advanced Responsive Video Embedder plugin distributed an unauthenticated backdoor through standard update channels.
The WordPress Rescue Engine upgrades your existing design, content, and search authority into a modern, pre-rendered architecture distributed across hundreds of data centers on the global edge. Zero databases to breach. Zero plugins to patch. Sub-second page loads.