Critical Forminator WordPress Flaw Allows Unauthenticated RCE via Malicious PHP Uploads
A critical vulnerability has been disclosed in the Forminator Forms WordPress plugin, which has over 600,000 active installations. Tracked as CVE-2026-15748 and…
Tag: Wordfence
BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins
Cybersecurity researchers have uncovered a supply chain attack targeting WordPress plugin vendor BdThemes, leading to the temporary suspension of several plugins from…
Hackers Exploit Unpatched Windmill Path Traversal Flaw CVE-2026-29059 to Read Server Files
A high-severity path traversal vulnerability in the open-source developer platform Windmill, tracked as CVE-2026-29059 (CVSS 7.5), is under active exploitation. The flaw…
Exposed Hacker Server Reveals WP-SHELLSTORM Backdooring Thousands of WordPress Sites
A cybercrime crew left its server exposed for three weeks, revealing the inner workings of a mass site-hacking operation tracked as WP-SHELLSTORM.…
Supply Chain Attack Hits Three WordPress Plugins: PushEngage, OptinMonster, TrustPulse Backdoored
An attacker tampered with trusted JavaScript files used by WordPress sites running PushEngage, OptinMonster, and TrustPulse, turning those files into a way…
Hackers Exploit Gravity SMTP WordPress Plugin Bug to Expose API Keys
Threat actors are actively exploiting a recently patched medium-severity information disclosure vulnerability in the Gravity SMTP WordPress plugin, which is installed on…
ShapedPlugin WordPress Pro Plugins Backdoored in Supply Chain Attack
Multiple WordPress plugins from ShapedPlugin were compromised in a supply chain attack after unknown threat actors tampered with the official release channels…
Wordfence: WordPress Security Company
Wordfence is a prominent WordPress security company that provides firewall, malware scanning, and threat intelligence services. It disclosed and analyzed critical vulnerabilities…