CVE/vulnerability
CISA Warns of Active Attacks Exploiting WordPress Core Code Execution Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included a WordPress Core vulnerability in its Known Exploited Vulnerabilities catalog due to evidence of active exploitation.
This vulnerability, identified as...
ChatGPT
New ChatGPT Phishing Kit Uses Rotating WordPress Websites to Steal Payment Details and OTPs
A phishing campaign impersonating OpenAI is using disposable WordPress websites and live attacker oversight to steal payment card details and potentially capture one-time passwords....
Cyber Security News
WordPress 7.1.4 Security Update Patches 22 Vulnerabilities Affecting Millions of Websites
WordPress has released version 7.1.4 to address 22 vulnerabilities, including issues related to remote code execution, stored cross-site scripting, information disclosure, and authorization weaknesses....
cyber security
New TRUST#GRAFT Attack Tricks WordPress Admin Browsers Into Installing Malicious Plugins
TRUST#GRAFT, a JavaScript-to-WordPress attack chain that never breaks WordPress authentication.
Instead, it borrows the trust placed in an already logged-in administrator's browser and uses...
Cyber Security News
Hackers Exploit Compromised UpdraftCentral Keys to Install Malicious Plugins on WordPress Sites
Attackers exploited compromised UpdraftCentral connection keys to send trusted remote-management commands to WordPress sites, ultimately installing malicious plugins that could provide unauthorized access to...
Cyber Security News
Rank Math PRO WordPress Plugin Compromised to Spread Malware and Steal Credentials
Rank Math has reported a security incident involving malware distributed through Rank Math PRO version 3.0.123.
They warn that WordPress websites using this compromised...
cyber security
Hackers Can Take Over WordPress Websites Without a Password Using Two Security Flaws
Hackers can compromise vulnerable WordPress websites without stealing passwords by chaining two security flaws in the platform’s core.
Disclosed in July 2026, the chain...
CVE/vulnerability
Critical WordPress Bricksforge Flaw Lets Unauthenticated Attackers Execute Remote Code
Attackers are actively targeting a critical vulnerability in the Bricksforge WordPress plugin. This flaw allows unauthenticated users to upload malicious files and execute arbitrary...
AWS
TIKTOUK WordPress Toolkit Could Enable AWS, SMTP and API Credential Theft Attacks
A credential-collection toolkit dubbed TIKTOUK that combines WordPress reconnaissance, exposed-file harvesting, plugin credential decryption, and JavaScript secret scanning.
The toolkit consists of two Python...
cyber security
SC WordPress Malware Rebuilds Itself After Removal Using Database and Memory Persistence
A newly analyzed WordPress malware family, tracked as SC for the “SC_” markers embedded in its injected code, uses a self-healing persistence mesh that...
cyber security
Exvicy ClickFix Malware-as-a-Service Copies ErrTraffic to Hijack WordPress Sites
A new Malware-as-a-Service platform, Exvicy, is actively abusing compromised WordPress websites to deliver ClickFix lures disguised as Cloudflare Turnstile verification pages.
Researchers at Sekoia...