Tracked topic
… WordPress describes it as a high-severity SQL injection vulnerability affecting WordPress 6.8 and later. According to the WordPress advisories, the complete RCE chain affects WordPress 6.9.0 through 6.9.4 and WordPress 7.0.0 through 7.0.1. …
… Get the whitepaper Related Articles: WordPress Core "wp2shell" RCE flaws get public exploits, patch now Hackers exploit info disclosure bug in Gravity SMTP WordPress plugin Critical Everest Forms Pro flaw exploited to take over WordPress sites WP Maps Pro bug exploited to create admin accounts on W… …
WordPress malware campaign hides payloads in Steam profiles By Bill Toulas June 1, 2026 01:04 PM Nearly 2,000 WordPress websites were infected with malware that relies on Steam Community profile comments to hide command-and-control C2 data. …
OptinMonster WordPress plugin hacked in CDN supply-chain attack By Bill Toulas June 15, 2026 01:37 PM WordPress plugins OptinMonster, TrustPulse, and PushEngage have been compromised in a supply-chain attack impacting Awesome Motive's content distribution network CDN . …
… Get the whitepaper Related Articles: OptinMonster WordPress plugin hacked in CDN supply-chain attack WP Maps Pro bug exploited to create admin accounts on WordPress sites Avada Builder WordPress plugin flaws allow site credential theft Official CheckMarx Jenkins package compromised with infostealer… …
… Download Now Related Articles: WP Maps Pro bug exploited to create admin accounts on WordPress sites Hackers exploit critical flaw in Ninja Forms WordPress plugin Avada Builder WordPress plugin flaws allow site credential theft Hackers exploit auth bypass flaw in Burst Statistics WordPress plugin H… …
… Get the whitepaper Related Articles: Critical Everest Forms Pro flaw exploited to take over WordPress sites WP Maps Pro bug exploited to create admin accounts on WordPress sites Hackers exploit auth bypass flaw in Burst Statistics WordPress plugin Hackers exploit file upload bug in Breeze Cache Wor… …
… Get the whitepaper Related Articles: Critical Kirki flaw exploited to hijack WordPress admin accounts WP Maps Pro bug exploited to create admin accounts on WordPress sites Hackers exploit auth bypass flaw in Burst Statistics WordPress plugin Hackers exploit file upload bug in Breeze Cache WordPress… …
… ACSC lists the following products exploited in the campaign: Simple File List WordPress – CVE-2025-34085/CVE-2020-36847 WavePlayer WordPress – CVE-2025-12057 BerqWP WordPress – CVE-2025-7443 WPBookit WordPress – CVE-2025-7852 Ninja Forms WordPress – CVE-2026-0740 ThemeREX Addons WordPress – CVE-202… …
… While the Dutch police removed the malware and backdoors from the infected sites, it also advised the website owners to change their credentials, enable multi‑factor authentication, delete any unknown WordPress accounts, and keep their WordPress site up‑to‑date. …
