CISA Now Lists the WordPress Core Upgrade Flaw as Exploited, With 240,000+ Attempts Blocked
Attackers have tried 240,000+ times to exploit the WordPress core upgrade flaw, and CISA now lists it as exploited. Confirm you run 7.1.4.
Wordfence Confirms the Brotli Flaw Can Run Code on a WordPress Server
Wordfence reproduced remote code execution on WordPress through the Brotli flaw, not just a crash. Ask your host to patch Brotli now.
A Server Library Flaw Can Crash WordPress Through One Anonymous Request
A server library flaw lets one anonymous request crash your PHP workers. WordPress has no update for it, so ask your host to patch Brotli.
Issue 25: Another Core Security Release, and a Plan to Make WordPress Agent-Ready
WordPress 7.1.4 is the seventh core security release since July. PHP attacks are climbing, and WordPress wants AI agents connecting by 7.3.
Attackers Are Probing the WordPress 7.1.4 Upgrade Flaw. Check That You Updated
Attackers are probing the WordPress 7.1.4 upgrade flaw, and Wordfence says 22 flaws were fixed. Confirm your site updated to 7.1.4.
WordPress 7.1.4 Fixes 13 Security Issues, Including a Flaw in the Upgrade Process
WordPress 7.1.4 fixes 13 security issues, including a flaw in the upgrade process that can allow code execution. Update your site now.
Attacks on the New PHP Flaws Are Climbing. Update PHP and Restart It
Wordfence has blocked 74,000+ attempts to exploit the new PHP flaws, with no confirmed hacks yet. Update PHP and restart it.
Issue 24: Two Plugin Vendors Breached, and PHP Needs Patching
Rank Math and UpdraftPlus were breached, and PHP needs a server update. WordPress 7.2 Beta 1 is out, and MCP may be heading for core.
UpdraftPlus Now Has a Fix for the Stolen-Key Attacks. Update and Reset Your Password
UpdraftPlus 1.26.13 and 2.26.13 now revoke stolen UpdraftCentral keys. Update, change your TeamUpdraft password, and check for rogue admins.
Two Critical PHP Flaws Put WordPress Servers at Risk. Update PHP Now
Two critical PHP flaws can let attackers run code on your server without logging in. WordPress updates won't fix them. Update PHP now.
Stolen UpdraftCentral Keys Are Being Used to Backdoor WordPress Sites
Stolen UpdraftCentral keys are letting an attacker install backdoors on WordPress sites. No update fixes it yet. Delete your keys now.
Some Rank Math SEO PRO 3.0.123 Downloads Contained Malware. Update to 3.0.124
Some Rank Math SEO PRO 3.0.123 downloads contained malware. If you updated on Oct 15 or 16, treat your site as compromised and update to 3.0.124.
Backuply Flaw Can Give Attackers Admin Access During a Restore. Update to 1.5.9
Update Backuply to 1.5.9 or later. A logged-in attacker can plant malicious data that takes over your site when you restore a database backup.
Issue 23: Patch Your Plugins, and Ask Your Host About Ghostscript
Backuply and All in One SEO need updates, and a critical Ghostscript flaw sits on your server, not in WordPress. Gutenberg 24.2 turns on React 19.
All in One SEO Patched Two Security Flaws. Update to 5.0.2.1
All in One SEO, used on 2 million+ sites, patched two medium-severity flaws. Update to 5.0.2.1 or later to close both of them.
A Critical Ghostscript Flaw Could Let a Crafted PDF Take Over Your WordPress Server
A critical Ghostscript flaw (CVSS 9.8) can let a crafted PDF run code on your server. There is no plugin to update, so ask your host if it is patched.
Issue 22: Three Plugins Under Attack, and WordPress Opens a Door for AI
Attackers are exploiting Bricksforge, Ninja Forms, and WPC Product Bundles. WordPress 7.1.3 fixes 7 flaws, and the MCP Adapter hits the plugin directory.
Attackers Are Exploiting a Critical Bricksforge Flaw to Upload Code Without a Login
Attackers are exploiting a critical Bricksforge flaw that lets anyone upload and run PHP code without logging in. Update to 3.1.8.10 now.
Attackers Are Exploiting Ninja Forms and WPC Product Bundles to Plant Hidden Admins
Attackers are exploiting Ninja Forms and WPC Product Bundles flaws to plant hidden admin accounts. Update, then check for rogue users.
WordPress 7.1.3 Fixes 7 Security Flaws, Including Exposed Private Comments
WordPress 7.1.3 fixes 7 security flaws, including stored XSS in comment moderation and exposed private comments. Update your site now.
Issue 21: One Click Makes a Rogue Admin, and Few Have a Recovery Plan
A critical Elementor flaw lets one clicked link create a rogue admin. Update to 4.3.2. Only 27.9% of WordPress pros have a hack recovery plan.
Most WordPress Pros Still Have No Plan for Recovering From a Hack
Only 27.9% of WordPress pros have a breach recovery plan, a Melapress survey finds. Most learn of hacks when someone notices the site acting strangely.
A CSRF Flaw in Elementor Lets a Single Click Create a Rogue Admin Account
A critical flaw in Elementor, active on 10 million+ sites, lets one clicked link create a rogue admin account. Update to 4.3.2 now.
Issue 20: A Second Critical WordPress Patch, Under Attack Within a Day
WordPress 7.1.2 patches a critical, unauthenticated flaw already under active attack. A Tutor LMS bug and blockchain-hiding malware also demand attention.