Info Security Magazine
1 month ago
Attackers Hijack Popular WordPress Plugins to Deploy Backdoors
Tampered OptinMonster and sister plugins plant hidden backdoors on 1.2 million WordPress sites
Security news aggregator
Latest coverage for Wordpress
WordPress is a content management platform whose core, plugins, and themes can contain vulnerabilities that expose websites, accounts, and data.
45
headlines in this view
Refine the feed
Search across headline titles and summaries.
Tag briefing
Background for this topic.
WordPress is an open-source content management system (CMS) used to publish and manage websites. A site typically combines WordPress core with independently developed plugins and themes, which extend functionality but create a diverse and changing software supply chain. Its security therefore depends not only on the core software, but also on the quality, maintenance, and configuration of those extensions.
Security-relevant issues include exploitable vulnerabilities in core, plugins, or themes; weak or reused administrator credentials; and exposed or poorly configured administrative and API interfaces. Attackers may use these paths to alter content, install malicious code, or access site data. Administrators should track advisories and affected versions, apply updates through a controlled process, remove unsupported extensions, enforce strong authentication and least privilege, and keep protected, tested backups. Monitoring and log review help identify unauthorized changes and support recovery when compromise is suspected.
Volume over time
Weekly headline count for the current query.
Showing 20 most recent headlines of 45
Filtered view
Info Security Magazine
1 month, 2 weeks ago
Everest Forms Pro Vulnerability Allows Remote Code Execution on WordPress Sites
Critical Everest Forms Pro RCE flaw exploited to create rogue WordPress admin accounts
Info Security Magazine
2 months ago
Avada Builder Flaws Expose One Million WordPress Sites
Avada Builder flaws allowed file read and SQL injection on one million WordPress sites
Info Security Magazine
3 months, 1 week ago
Critical Vulnerability in Ninja Forms Exposes WordPress Sites
Ninja Forms File Upload RCE via unauthenticated arbitrary file upload; update to 3.3.27 immediately
Info Security Magazine
4 months, 1 week ago
Compromised WordPress Sites Deliver ClickFix Attacks in Global Infostealer Campaign
Over 250 legitimate websites, including news outlets and a US Senate candidate’s official webpage, been compromised to infect visitors with infostealers, warn Rapid7 researchers
Info Security Magazine
5 months, 2 weeks ago
SQL Injection Flaw Affects 40,000 WordPress Sites
40,000 WordPress sites are vulnerable to SQL injection in Quiz and Survey Master plugin
Info Security Magazine
5 months, 3 weeks ago
RealHomes CRM Plugin Flaw Affected 30,000 WordPress Sites
Security flaw in RealHomes CRM plugin allowed file uploads; patches released for 30,000+ sites
Info Security Magazine
7 months ago
Motors WordPress Vulnerability Exposes Sites to Takeover
A critical flaw in the Motors WordPress theme affecting more than 20,000 installations allows low-privileged users to gain full control of websites
Info Security Magazine
8 months, 3 weeks ago
Critical WordPress Plugin Bugs Exploited En Masse
Wordfence says threat actors are trying to exploit three critical vulnerabilities from 2024
Info Security Magazine
9 months ago
Flaw in Slider Revolution Plugin Exposed 4m WordPress Sites
A flaw in the Slider Revolution plugin has exposed millions of WordPress sites to unauthorized file access
Info Security Magazine
10 months, 2 weeks ago
Critical SQLi Threat to WordPress Memberships Plugin Users
A vulnerability in the WordPress Paid Memberships Subscription plugin could lead to unauthenticated SQL injection on affected sites
Info Security Magazine
11 months, 2 weeks ago
Critical Flaws in WordPress Plugin Leave 10,000 Sites Vulnerable
10,000 WordPress sites vulnerable to takeover due to critical flaws in HT Contact Form Widget plugin
Info Security Magazine
1 year ago
WordPress Plugin Flaw Exposes 600,000 Sites to File Deletion
A severe flaw identified in the Forminator WordPress plugin allows arbitrary file deletion and potential site takeover
Info Security Magazine
1 year ago
Malware Campaign Uses Rogue WordPress Plugin to Skim Credit Cards
A long-running malware campaign targeting WordPress via a rogue plugin has been observed skimming data, stealing credentials and user profiling
Info Security Magazine
1 year, 1 month ago
PayU Plugin Flaw Allows Account Takeover on 5000 WordPress Sites
Vulnerability in PayU CommercePro plugin allows account hijacking on thousands of WordPress sites
Info Security Magazine
1 year, 2 months ago
New WordPress Malware Masquerades as Plugin
New WordPress malware disguised as a plugin gives attackers persistent access and injects malicious code enabling administrative control
Info Security Magazine
1 year, 3 months ago
Major WordPress Plugin Flaw Exploited in Under 4 Hours
Flaw in SureTriggers plugin allows unauthenticated users to create admin accounts on WordPress sites
Info Security Magazine
1 year, 4 months ago
Vulnerability in Chaty Pro Plugin Exposes 18,000 WordPress Sites
An arbitrary file upload vulnerability in the Chaty Pro plugin has been identified, affecting 18,000 WordPress sites
Info Security Magazine
1 year, 4 months ago
Essential Addons for Elementor XSS Vulnerability Discovered
Elementor plugin flaw puts 2m WordPress websites at risk, allowing XSS attacks via malicious scripts
Info Security Magazine
1 year, 4 months ago
WordPress Plugin Vulnerability Exposes 90,000 Sites to Attack
A flaw in the Jupiter X Core plugin has been identified, allowing upload of malicious SVG files and remote code execution on vulnerable servers
Loading more headlines...