Wordpress

7 articles

CVEWordpress

WordPress update hijack bug is now on CISA's exploited list: check your last update (CVE-2026-119977)

How to fix CVE-2026-119977: upgrade WordPress to 7.1.4 (or your branch's fixed release) and block web access to wp-content/upgrade/. CISA listed it as exploited on Nov 3, so also check whether your last update was hijacked.

HOL Guard
BreakingWordpress

WordPress 7.1.4 closes a no-login takeover window during core updates. Update, then lock wp-content/upgrade/

How to fix the WordPress 7.1.4 upgrade race: upgrade WordPress to 7.1.4 (or 7.0.8, 6.9.11, 6.8.12) and block web access to wp-content/upgrade/. Before 7.1.4, anyone hitting the right path mid-update could reach the unpacked installer. 21 more bugs need an account.

HOL Guard
BreakingCVE

PHP2Shell lets attackers run code on PHP web servers with no login. Update PHP now (CVE-2026-109618, CVE-2026-109619)

How to fix CVE-2026-109618: upgrade PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, then restart Apache and PHP-FPM. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets attackers run code on PHP web servers with no login. PHP 8.1 and older get no upstream fix.

HOL Guard
CVEWordpress

WordPress page template include hits CISA KEV

How to fix CVE-2026-87902: upgrade WordPress to 7.1.2 (or your branch patch).

HOL Guard
BreakingCVE

WordPress comment XSS lets strangers plant script (7.1.1)

How to fix CVE-2026-93485: upgrade WordPress to 7.1.1

HOL Guard
BreakingCVE

CVE-2026-18432 - Frontend Admin WordPress Unauthenticated Admin Takeover

CVE-2026-18432 is a CVSS 9.8 privilege-escalation flaw in Frontend Admin by DynamiApps that can let unauthenticated attackers reset the default WordPress administrator account. Update to 3.29.10.

HOL Guard
BreakingCVE

CVE-2026-19598 - Pods WordPress Plugin Unauthenticated Admin Takeover

CVE-2026-19598 is a CVSS 9.8 authorization bypass in the Pods WordPress plugin that lets unauthenticated attackers reach admin methods and take over sites. Update to 3.3.9.1.

HOL Guard

Related topics

Keep exploring

The engineering desk continues across the ecosystem: security research on shipping agents safely, and plugins that put the standards to work.

Security research hubPlugin marketplace