WebToffee PDF Invoices Vulnerability Exposes Server Files
A vulnerability in WebToffee WooCommerce PDF Invoices can allow Subscriber-level users to read sensitive server files through generated invoices. Stores…
WordPress vulnerability
Security Hardener Vulnerability Lets Subscribers Become Admins
A high-severity Security Hardener vulnerability can allow authenticated WordPress subscribers to bypass normal REST API permission checks and create administrator…
WPForms Pro Vulnerability: Public Forms Can Inject JavaScript
A new WPForms Pro vulnerability allows unauthenticated visitors to store malicious JavaScript through public form fields. Administrators reviewing affected entries…
Critical Automation Web Platform Vulnerability: Remove It Now
A critical Automation Web Platform vulnerability tracked as CVE-2026-77264 can expose authentication tokens and allow unauthenticated attackers to access WordPress…
Critical Elementor Pro Vulnerability: Check Your Forms Now
A critical Elementor Pro vulnerability tracked as CVE-2026-32475 can allow unauthenticated attackers to bypass file-extension checks and upload executable PHP…
Critical Forminator Vulnerability Threatens 600,000 WordPress Sites
A serious Forminator vulnerability affecting file-upload handling could expose WordPress websites to malicious uploads and possible compromise. Administrators using Forminator…
Critical Solace Extra Vulnerability: Update Now
A serious Solace Extra vulnerability can allow unauthenticated attackers to permanently delete WordPress content imported through Starter Templates. Administrators running…
Critical User Profile Builder Flaw Enables Admin Takeover
A critical User Profile Builder vulnerability can allow unauthenticated attackers to access the WordPress account with user ID 1. Learn…
WordPress 7.0.4 Security Update Fixes an Author-Level RCE
WordPress 7.0.4 addresses a serious remote code execution risk involving malicious image-like uploads, Imagick, and Ghostscript. This guide explains the…