Security news aggregator

Latest coverage for Wordpress

WordPress is a content management platform whose core, plugins, and themes can contain vulnerabilities that expose websites, accounts, and data.

6 headlines in this view

Refine the feed

Search across headline titles and summaries.

Tag briefing

Background for this topic.

WordPress is an open-source content management system (CMS) used to publish and manage websites. A site typically combines WordPress core with independently developed plugins and themes, which extend functionality but create a diverse and changing software supply chain. Its security therefore depends not only on the core software, but also on the quality, maintenance, and configuration of those extensions.

Security-relevant issues include exploitable vulnerabilities in core, plugins, or themes; weak or reused administrator credentials; and exposed or poorly configured administrative and API interfaces. Attackers may use these paths to alter content, install malicious code, or access site data. Administrators should track advisories and affected versions, apply updates through a controlled process, remove unsupported extensions, enforce strong authentication and least privilege, and keep protected, tested backups. Monitoring and log review help identify unauthorized changes and support recovery when compromise is suspected.

Volume over time

Weekly headline count for the current query.

Showing 6 most recent headlines Filtered view

Australia warns of a global campaign exploiting CMS flaws to deploy webshells on WordPress, Joomla, and other websites. Australia’s Signals Directorate has issued an alert about a large-scale exploitation campaign actively targeting content management systems (CMS) worldwide, with many small and medium-sized Australian businesses already hit. Attackers are scanning websites for known vulnerabilities, deploying webshells […]

Security Affairs 13 Jul 2026, 7:39 p.m. Incident · 3 stories Australia Flaw Vulnerability Warning Wordpress

Attackers compromised Awesome Motive CDN files, backdooring WordPress sites running OptinMonster, TrustPulse, and PushEngage. Sansec researchers discovered an active supply chain attack hitting WordPress sites running OptinMonster, TrustPulse, and PushEngage, three plugins operated by Awesome Motive, one of the largest WordPress plugin companies in the world. The malicious JavaScript wasn’t sitting on any victim’s server. […]

Security Affairs 15 Jun 2026, 8:34 p.m. Incident · 2 stories Compromise JavaScript Research Supply Chain Victims Wordpress

Hackers exploit CVE-2026-3300 in Everest Forms Pro to inject PHP via form fields, creating rogue admin accounts. 29,300 attempts blocked. Researcher h0xilo submitted a flaw in Everest Forms Pro for WordPress, tracked as CVE-2026-3300, to Wordfence’s bug bounty program and earned $325 for it. WPEverest patched the flaw on March 18. Wordfence published a full […]

Security Affairs 9 Jun 2026, 2:11 a.m. Incident · 6 stories CVE-2026-3300 Bug Bounty CVE Exploit Flaw Patch PHP Wordpress
Security Affairs 1 month, 1 week ago

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 100

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter Malware Targeting WordPress Abuses Steam Community Profiles for Command & Control Operations   Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens   Operation Dragon Weave : Uncovering a China-Linked Campaign Targeting Czech Republic and Taiwan […]

Security Affairs 8 Jun 2026, 3:38 a.m. Theme · 8 stories Artificial Intelligence China Czechia Malware Research Taiwan Wordpress

Malware on approximately 2,000 WordPress sites hid C2 instructions in Steam profile comments using invisible Unicode. GoDaddy researchers spotted a command-and-control infrastructure for a malware campaign abusing Valve’s Steam gaming platform. The experts discovered malware on approximately 1,980 WordPress sites that fetches its instructions by reading Steam Community profile comments, where the actual payload is […]

Security Affairs 2 Jun 2026, 5:38 p.m. Incident · 2 stories Command and Control Gaming Malware Research Wordpress

CVE-2026-8732 in WP Maps Pro lets unauthenticated attackers create WordPress admin accounts. 2,858 attacks blocked in 24 hours. WP Maps Pro plugin allows WordPress site owners to embed Google Maps and OpenStreetMap with markers, listings, and location search. It’s a store locator tool. Unremarkable. The plugin is installed on over 15,000 websites, according to sale […]

Security Affairs 1 Jun 2026, 11:36 p.m. Incident · 4 stories CVE-2026-8732 CVE Flaw Google Unauthenticated Wordpress