Critical Paytium Vulnerability Enables Admin Creation
A critical Paytium vulnerability tracked as CVE-2026-18467 can allow unauthenticated attackers to create WordPress administrator accounts under specific payment-form conditions….
wordpress security
WordPress 7.1.2 Fixes Critical RCE Vulnerability
WordPress 7.1.2 fixes a critical unauthenticated path traversal vulnerability that can lead to remote code execution under specific theme and…
Critical JetFormBuilder Vulnerability Is Under Active Attack
A critical JetFormBuilder vulnerability can allow unauthenticated attackers to create WordPress administrator accounts through unsafe form validation. Site owners running…
Site Security & Redirects
Site Security & Redirects gives WordPress administrators a clean way to manage maintenance mode, disable XML-RPC, and enforce HTTPS. Version…
Eventin Vulnerability Restores Admin Power to User ID 1
A high-severity Eventin vulnerability can give administrator-equivalent capabilities back to WordPress user ID 1 after the account has been demoted….
MotoPress Hotel Booking Stripe XSS Vulnerability
A MotoPress Hotel Booking vulnerability can expose premium installations using Stripe to stored XSS when webhook signature verification is not…
Critical WooCommerce Wholesale Lead Capture Vulnerability
A critical WooCommerce Wholesale Lead Capture vulnerability is being actively exploited to upload dangerous files to WordPress servers. Store owners…
Really Simple Security Vulnerability Can Bypass Email 2FA
A Really Simple Security vulnerability can reset completed email two-factor authentication, potentially allowing an attacker who already knows a WordPress…
Critical The Events Calendar Vulnerabilities Demand Action
Two critical The Events Calendar vulnerabilities can expose WordPress websites to unauthenticated remote code execution. Site owners should update directly…
Unlimited Elements Vulnerability: Critical SQL Injection
A critical Unlimited Elements vulnerability allows unauthenticated attackers to target the WordPress database through SQL injection. Sites using affected Unlimited…