CVE-2026-65640: WordPress Core Postscript RCE
High-severity WordPress core vulnerability enabling remote code execution via malicious Postscript file upload by Author-level users. Affects versions 4.7 to 7.0. Patched…
Tag: WordPress
Lazarus Group Exploits Windows Zero-Day CVE-2026-68820 in Operation Dream Job Attacks
The North Korean threat actor known as Lazarus Group has been attributed to the zero-day exploitation of a newly patched Microsoft Windows…
BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins
Cybersecurity researchers have uncovered a supply chain attack targeting WordPress plugin vendor BdThemes, leading to the temporary suspension of several plugins from…
CVE-2026-18072: Advanced Responsive Video Embedder Backdoor
CVE-2026-18072 is a vulnerability in the Advanced Responsive Video Embedder WordPress plugin that was exploited in a supply chain attack to grant…
w2.js: Malicious JavaScript Payload in BdThemes Supply Chain Attack
w2.js is a JavaScript payload used in the BdThemes supply chain attack. It contacts a C2 server, creates rogue admin accounts, installs…
x.js: Deterministic Credential Generator Payload
x.js is an alternate payload in the BdThemes attack that generates deterministic administrative credentials based on the victim website's hostname, allowing attackers…
Magic-Login Backdoor: Unauthenticated Admin Access
The magic-login backdoor is a persistence module installed in the mu-plugins directory that allows unauthenticated administrative entry via a URL parameter targeting…
BdThemes: WordPress Plugin Vendor Hit by Supply Chain Attack
BdThemes is a WordPress plugin vendor whose plugins were compromised in a supply chain attack via poisoned JSON data, leading to temporary…
Element Pack Addons for Elementor: Affected Plugin
Element Pack Addons for Elementor is a WordPress plugin with over 100,000 active installs that was affected by the BdThemes supply chain…
Live Copy Paste for Elementor: Affected Plugin
Live Copy Paste for Elementor is a WordPress plugin with 6,000+ active installs that was affected by the BdThemes supply chain attack…