A CSRF vulnerability in the Elementor WordPress plugin could enable attackers to create unauthorised administrator accounts, potentially leading to full website compromise.
A Chinese-speaking threat actor exploited vulnerabilities in ZyXEL GS1900 switches and WordPress to steal over 18,500 records from backend databases.
WordPress has issued updates to fix the ‘Click2Shell’ vulnerability, a flaw that allows unauthenticated attackers to potentially execute remote code.
Attackers are exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin to upload PHP webshells and execute remote code on WordPress sites.
WordPress has introduced automated security reviews for plugin releases to identify malicious code and vulnerabilities before they reach users through the update API.
