wordpress security Archives • Daily CyberSecurity

TranslatePress Flaw (CVE-2026-19632) Exposes 400,000 WordPress Sites to Account Takeover TranslatePress account takeover vulnerability warning for WordPress admins, password reset link disclosure CVE-2026-19632

TranslatePress account takeover vulnerability warning for WordPress admins, password reset link disclosure CVE-2026-19632

TranslatePress Flaw (CVE-2026-19632) Exposes 400,000 WordPress Sites to Account Takeover

Do Son August 25, 2026

TL;DR A critical flaw in TranslatePress lets unauthenticated attackers steal an administrator’s password reset link. Attackers can...

StopAndProtect Malware Turns Hacked WordPress Sites Into a Botnet StopAndProtect malware ClickFix fake CAPTCHA prompt on hacked WordPress sites

StopAndProtect malware ClickFix fake CAPTCHA prompt on hacked WordPress sites

StopAndProtect Malware Turns Hacked WordPress Sites Into a Botnet

Do Son August 24, 2026

At a glance Actor / group Unnamed operator behind “StopAndProtect” (internal project names “0a_botnet” and “fake-captcha”) Activity...

CVE-2026-15826: User Profile Builder Bug Under Active Attack, Grants Full Admin Takeover (CVSS 9.8) User Profile Builder vulnerability CVE-2026-15826 WordPress authentication bypass illustration

CVE-2026-15826: User Profile Builder Bug Under Active Attack, Grants Full Admin Takeover (CVSS 9.8)

Do Son August 15, 2026

TL;DR: A critical User Profile Builder vulnerability, carrying a maximum CVSS score of 9.8 and tracked as...

BdThemes Supply Chain Attack Poisons Plugin API to Hijack WordPress Admins BdThemes supply chain attack diagram showing a poisoned WordPress plugin API feed injecting XSS into an admin dashboard

BdThemes supply chain attack diagram showing a poisoned WordPress plugin API feed injecting XSS into an admin dashboard

BdThemes Supply Chain Attack Poisons Plugin API to Hijack WordPress Admins

Do Son August 9, 2026

At a Glance Malware family API-driven XSS supply chain implant (Biggopti banner abuse) Threat actor Suspected; linked...

CVE Weekly Roundup: July 27 – August 2, 2026 CVE weekly roundup dashboard showing 2077 new vulnerabilities and CISA KEV additions

CVE Weekly Roundup: July 27 – August 2, 2026

Do Son August 3, 2026

The CVE WATCHTOWER logged 2,077 new vulnerabilities between July 27 and August 2, 2026. This CVE weekly...

wp2shell: WordPress Core RCE Exploited in the Wild as Public PoC Code Circulates wp2shell exploit chain achieving WordPress Core RCE via CVE-2026-63030 and CVE-2026-60137 batch API abuse

wp2shell exploit chain achieving WordPress Core RCE via CVE-2026-63030 and CVE-2026-60137 batch API abuse

wp2shell: WordPress Core RCE Exploited in the Wild as Public PoC Code Circulates

Do Son July 21, 2026

Attackers are already dropping webshells on WordPress sites through a flaw in WordPress Core itself. The bug...

WordPress Sites at Risk: Outdated PHP, Plugins, and Default Configs WordPress outdated PHP end-of-life security risk chart showing plugin and PHP version gaps

WordPress outdated PHP end-of-life security risk chart showing plugin and PHP version gaps

WordPress Sites at Risk: Outdated PHP, Plugins, and Default Configs

Do Son July 8, 2026

Hundreds of WordPress sites remain easy targets year after year. The cause is rarely a rare zero-day...

Operation Endgame Takes Down SocGholish, Amadey, and StealC Malware Operation Endgame takedown disrupting the SocGholish malware network

Operation Endgame Takes Down SocGholish, Amadey, and StealC Malware

Do Son June 25, 2026

At a Glance Actor / group SocGholish operator (TA569), linked to Russia’s Evil Corp; Amadey and StealC...

Valve Platform Exploited to Distribute WordPress Web Shells Steam profile malware campaign invisible Unicode steganography

Valve Platform Exploited to Distribute WordPress Web Shells

Do Son June 4, 2026

An Unconventional Command Network Emerges Cybersecurity defenders recently uncovered a highly unusual cyber espionage operation targeting website...

Critical WP Maps Pro Vulnerability Actively Exploited in the Wild WP Maps Pro vulnerability exploited in the wild

Critical WP Maps Pro Vulnerability Actively Exploited in the Wild

Do Son May 28, 2026

Recently, a major security threat emerged within the WordPress ecosystem. Attackers are actively targeting a critical flaw...

200K Sites at Risk: 9.8 CVSS RCE via Burst Statistics Auth Bypass Exploited in the Wild Burst Statistics Authentication Bypass CVE-2026-8181 Exploit

Burst Statistics Authentication Bypass CVE-2026-8181 Exploit

200K Sites at Risk: 9.8 CVSS RCE via Burst Statistics Auth Bypass Exploited in the Wild

Do Son May 14, 2026

In a major discovery for the WordPress ecosystem, PRISM, Wordfence Threat Intelligence’s autonomous vulnerability research platform, has...

Critical cPanel Auth Bypass CVE-2026-41940 Exploited by Thousands cPanel Authentication Bypass CVE-2026-41940 Exploitation

Critical cPanel Auth Bypass CVE-2026-41940 Exploited by Thousands

Do Son May 12, 2026

In the world of Linux server operations and virtual hosting management, cPanel & WHM is a cornerstone...

40,000+ Sites Exposed: Critical 9.8 CVSS Flaw Grants Total WordPress Account Takeover WordPress Account Takeover CVE-2026-7567

40,000+ Sites Exposed: Critical 9.8 CVSS Flaw Grants Total WordPress Account Takeover

Do Son May 2, 2026

A security vulnerability has been identified in Temporary Login, a popular WordPress plugin designed to provide secure,...

The CVE Watchtower: Weekly Threat Intelligence Briefing (April 20 – April 26, 2026) Vulnerability Digest AI Infrastructure Security

The CVE Watchtower: Weekly Threat Intelligence Briefing (April 20 – April 26, 2026)

Do Son April 27, 2026

Welcome to your Monday morning vulnerability digest. As we close out the final full week of April,...

Over 400,000 WordPress Sites at Risk as “Breeze” Plugin Zero-Day Is Exploited in the Wild WordPress RCE Breeze Plugin Vulnerability

Over 400,000 WordPress Sites at Risk as “Breeze” Plugin Zero-Day Is Exploited in the Wild

Do Son April 23, 2026

A major security threat is currently sweeping through the WordPress ecosystem. Breeze, a highly popular caching plugin...

100,000+ Sites Exposed: Critical 9.8 CVSS Flaw Hits Everest Forms WordPress Plugin Everest Forms Vulnerability PHP Object Injection

100,000+ Sites Exposed: Critical 9.8 CVSS Flaw Hits Everest Forms WordPress Plugin

Do Son April 9, 2026

Everest Forms, a popular WordPress plugin trusted by over 100,000 websites for building everything from simple contact...

Ninja Forms Alert: Critical 9.8 RCE Vulnerability Under Active Attack Ninja Forms RCE WordPress Vulnerability

Ninja Forms Alert: Critical 9.8 RCE Vulnerability Under Active Attack

Do Son April 6, 2026

In a major alert for the WordPress community, a critical security flaw has been disclosed in the...

The CVE Watchtower: Weekly Threat Intelligence Briefing (March 23 – March 29, 2026) Vulnerability Triage CISA KEV List

The CVE Watchtower: Weekly Threat Intelligence Briefing (March 23 – March 29, 2026)

Do Son March 30, 2026

Whether you are steering the organizational ship as a CISO or maintaining the operational engines as a...

Hackers Actively Exploiting 9.8 Critical RCE Flaw in Kali Forms WordPress Plugin

Do Son March 26, 2026

The attackers begin actively exploiting a critical vulnerability in Kali Forms, a popular drag-and-drop form builder WordPress...

shell-quote command injection AI-Driven Vulnerabilities Q1 2026 Cyber Threats vm2 Sandbox Escape Node.js RCE upKeeper Privilege Escalation CVE-2026-2449 Pharos Controls Vulnerability Root Access Exploit Cybersecurity Vulnerability Roundup CVSS 10.0 Flaws Shadow Archives CVE-2026-0866 MS-Agent Prompt Injection CVE-2026-2256 basic-ftp Path Traversal CVE-2026-27699 telnetd Root Vulnerability CVE-1999-0073 Regression USR-W610 Vulnerabilities End-of-Life IoT Security IceWarp Security Update IceWarp Vulnerabilities Airleader Master Vulnerability CVE-2026-1358 ZLAN5143D Vulnerability CISA ICS Advisory Acronis Cyber Protect Vulnerability CVE-2025-30411 WAGO 852 Vulnerability OT Network Security SandboxJS Vulnerability Sandbox Escape (CVSS 10.0) Kubernetes Local Path Provisioner CVE-2025-62878 CISA Unresponsive Vendors Avation & RISS Vulnerabilities KiloView Vulnerability CVE-2026-1453 OpenClaw RCE vulnerability Johnson Controls Vulnerability CVE-2025-26385 SandboxJS Vulnerability CVE-2026-23830 ibaPDA Vulnerability CVE-2025-14988 Protobuf Vulnerability CVE-2026-0994 AVEVA Process Optimization Vulnerability CVE-2025-61937 ConnectWise PSA Vulnerability CVE-2026-0695 Aruba VIA Vulnerability CVE-2025-37186 aiohttp v3.13.3, Denial of Service (DoS) SmarterMail RCE, CVE-2025-52691 Airoha RACE, Headphone Jacking HPE OneView RCE CVE-2025-37164 FreePBX Auth Bypass, PBX Takeover ScreenConnect Config Flaw, Untrusted Extensions Ruby SAML Auth Bypass, XML Parser Differential Devolutions SQL Injection, Password Manager Flaw Vivotek Unauthenticated RCE, EOL IP Camera Flaw Lynx+ Critical Flaw, Unauthenticated Reset Firebox Default Credentials, CVE-2025-59396 Veeder-Root RCE, Critical ATG Flaw ArcGIS Server SQLi Watchdoc RCE, CVE-2025-58384 Delta DIALink Daikin Security Gateway, authentication bypass Frostbyte10, industrial controller security SunPower, vulnerability Ubiquiti UniFi Connect, EV Station Vulnerabilities Adobe Experience Manager, RCE Vulnerability UniFi Access, Command Injection LDAPNightmare - CVE-2025-1316

The Weekly Breach: 7 Maximum CVSS Flaws and the DarkSword Exploit Unveiled

Do Son March 23, 2026

The past seven days have been an exceptionally busy period for cybersecurity defenders. Between March 16 and...

The CAPTCHA Trap: How a Global ‘ClickFix’ Campaign Weaponizes WordPress to Drain Digital Wallets ClickFix Campaign WordPress Malware

The CAPTCHA Trap: How a Global ‘ClickFix’ Campaign Weaponizes WordPress to Drain Digital Wallets

Do Son March 18, 2026

In a sophisticated new campaign active since late 2025, a mysterious threat actor has been turning the...

The ‘Must-Patch’ Release: WordPress 6.9.2 Scrambles to Fix 10 Critical Flaws from XSS to SSRF WordPress 6.9.2 WordPress 6.9.2 WordPress Security Update WordPress Security Update WordPress.org Suspended

WordPress 6.9.2 WordPress 6.9.2 WordPress Security Update WordPress Security Update WordPress.org Suspended

The ‘Must-Patch’ Release: WordPress 6.9.2 Scrambles to Fix 10 Critical Flaws from XSS to SSRF

Do Son March 11, 2026

The WordPress security team has issued an urgent call to action following the release of WordPress 6.9.2...

Critical Alert 7 Active Exploits Detected Today