ALL POSTS

Key Findings CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalog on July 21, 2026, all showing active exploitation in the wild Two WordPress Core flaws can be chained together to achieve pre-authentication remote code execution on default installations running versions 6.9.x and 7.0.x Langflow vulnerability allows unauthenticated remote code execution with root privileges, rated critical with CVSS 9.8 DD-WRT router flaw is an older stack-based buffe

Key Findings Two critical WordPress Core vulnerabilities (CVE-2026-63030 and CVE-2026-60137) can be chained together to achieve pre-authentication remote code execution Public exploits are now available for the wp2shell attack chain Affected versions are WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1 WordPress has enabled forced automatic security updates due to severity Over 500 million websites worldwide use WordPress and are potentially at risk No plugins or valid credentials requi

Key Findings Anonymous HTTP requests can execute code on WordPress sites running core versions 6.9 through 7.0.1 without any plugins or authentication Two chained vulnerabilities, now assigned CVE-2026-63030 and CVE-2026-60137, combine a REST API batch-route confusion with SQL injection to bypass all protections WordPress patched the issue Friday with forced auto-updates to versions 6.9.5 and 7.0.2, but sites with auto-updates disabled remain vulnerable Full technical details

Key Findings Operation EndGame, a coordinated international law enforcement action, dismantled SocGholish infrastructure on June 18, 2026 106 servers and domains taken down globally; 14,971 compromised WordPress sites remediated Law enforcement from Netherlands, Canada, United States, and Germany executed the coordinated takedown with support from Europol SocGholish serves as initial access broker for major ransomware families including LockBit, RansomHub, and WastedLocker Be

Key Findings Gaming platform profiles weaponized to distribute WordPress web shells via invisible Unicode steganography Nearly 2,000 websites compromised through Steam profile command injection technique Critical Everest Forms Pro vulnerability (CVE-2026-3300, CVSS 9.8) actively exploited to create rogue admin accounts Attackers using cookie-authenticated backdoors to maintain persistent access and rewrite code remotely Over 17,900 exploit attempts blocked in single day as at

Key Findings New malware campaign discovered on approximately 1,980 WordPress sites using Steam Community profile comments to store encoded command-and-control instructions Malware uses invisible Unicode characters hidden within visible Steam profile comments to deliver payloads, making detection difficult Infected sites load external malicious JavaScript and contain a server-side backdoor capable of modifying PHP files for persistent access Campaign first detected in July 20

Key Findings CVE-2026-8732 in WP Maps Pro allows unauthenticated attackers to create WordPress administrator accounts remotely CVSS score of 9.8 indicates critical severity Over 2,858 attacks blocked in 24 hours, indicating active mass exploitation Affects all versions through 6.1.0; patched in version 6.1.1 released May 20, 2026 Plugin installed on 15,000+ WordPress sites according to Envato Market sales data Exploitation began before most site owners had time to patch after

Key Findings Critical vulnerability (CVE-2026-3844, CVSS 9.8) in Breeze Cache WordPress plugin allows unauthenticated file uploads Over 400,000 websites currently affected by the flaw Wordfence detected 170+ active attacks, with 3,936 blocked in 24 hours alone Vulnerability requires "Host Files Locally – Gravatars" option to be enabled, which is disabled by default Affects all versions up to 2.4.4; patch available in version 2.4.5 Background Breeze Cache is a popular free Wor

Key Findings A critical Remote Code Execution (RCE) vulnerability has been discovered in the Sneeit Framework, a core plugin bundled with multiple premium WordPress themes. The vulnerability (CVE-2025-6389) allows unauthenticated users to take complete control of a server. Threat actors started exploiting the issue on the same day it was publicly disclosed on November 24th, 2025. The Wordfence Firewall has already blocked over 131,000 exploit attempts targeting this vulnerabi

Key Findings A critical vulnerability, CVE-2025-8489 (CVSS score of 9.8), has been discovered in the WordPress plugin King Addons for Elementor. The flaw allows unauthenticated users to register and instantly gain admin privileges on WordPress sites. Threat actors are actively exploiting the vulnerability, with the Wordfence Firewall blocking over 48,400 exploit attempts since the issue was disclosed. The vulnerability is a privilege escalation issue in versions 24.12.92 to 5