Browsing Tag
Wordfence
8 posts
2 Critical Calendar WordPress Plugin Flaws Put 600K Sites at Risk of Takeover
Two critical RCE flaws in The Events Calendar expose 600,000+ WordPress installations to unauthenticated attacks, with CVSS scores of 9.8.
Account Takeover Flaw Hits TranslatePress Plugin Used on 400K WordPress Sites
The vulnerability, CVE-2026-19632, exposes WordPress admin password-reset links through TranslatePress, allowing unauthenticated attackers to take over affected WordPress websites.
Wordfence Finds Critical Backdoor in ARVE WordPress Plugin
A backdoored ARVE WordPress Plugin release could grant attackers administrator access with one token, but WordPress.org blocked automatic distribution to WordPress sites.
SQL Injection Vulnerability in Ally WordPress Plugin Exposes 200K+ Sites
SQL injection flaw in Ally WordPress plugin exposes 200,000+ sites to data theft. Patch released, but most installations remain unpatched and vulnerable.
Mass Attack Targets WordPress via GutenKit and Hunk Companion Plugins
Mass exploitation attacks are once again targeting WordPress websites, this time through serious vulnerabilities in two popular plugins,…
Auth Bypass Flaw in Service Finder WordPress Plugin Under Active Exploit
An Authentication Bypass (CVE-2025-5947) in Service Finder Bookings plugin allows any unauthenticated attacker to log in as an administrator. Over 13,800 exploit attempts detected. Update to v6.1 immediately.
New WordPress Malware Hides on Checkout Pages and Imitates Cloudflare
Wordfence exposes a sophisticated WordPress malware campaign using a rogue WordPress Core plugin. Active since 2023, it steals credit cards and credentials with advanced anti-detection.
Sneaky WordPress Malware Disguised as Anti-Malware Plugin
WordPress sites are under threat from a deceptive anti-malware plugin. Learn how this malware grants backdoor access, hides…