WordPress
Vulnerabilities across WordPress core and its plugin and theme ecosystem — the sprawling third-party attack surface that runs a large share of the public web, where a single popular plugin flaw can cascade into hundreds of thousands of compromised sites within days of disclosure.
WordPress core get_page_template path traversal enables unauthenticated RCE
Path traversal in WordPress core's get_page_template() enables unauthenticated local PHP file inclusion and conditional RCE. Actively exploited within 24 hours of disclosure. CVSS 8.1 High.
WordPress WP_Query author__not_in SQL injection (wp2shell companion)
A medium-severity SQL injection in WordPress WP_Query's author__not_in parameter (CVE-2026-60137). Tracked as the wp2shell companion. Patched in 6.8.6, 6.9.5, and 7.0.2.
WordPress Core unauthenticated RCE (wp2shell)
A critical unauthenticated remote code execution flaw in WordPress Core (CVE-2026-63030). GitHub Security Advisory issued July 17, 2026; public PoC circulating.
WordPress Social Warfare Plugin Cross-Site Scripting (XSS) Vulnerability
WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.
WordPress Snap Creek Duplicator Plugin File Download Vulnerability
WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.
WordPress File Manager Plugin Remote Code Execution Vulnerability
WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.
Bricksforge Plugin Flaw Gets Exploited Days After Patch
Attackers exploited CVE-2026-85097, a CVSS 9.8 unauthenticated file-upload RCE in Bricksforge, within days of public disclosure. Update to version 4.0.1.
Everest Backup RCE: No Patch for CVE-2026-39802
Everest Backup versions through 2.3.13 remain vulnerable to unauthenticated RCE. No fixed version is listed; temporarily deactivate the plugin if installed.
Booster for WooCommerce Has CVSS 9.8 Object Injection
Unauthenticated PHP Object Injection in Booster for WooCommerce plugin, versions up to 8.4.0, rates CVSS 9.8 critical. Update the plugin immediately.
SiteVault WordPress Plugin Has CVSS 10 RCE Bug
A CVSS 10.0 unauthenticated RCE in the SiteVault WordPress backup plugin hits versions 1.5.19 and earlier. No patch confirmed. Disable it now.
Three Critical WooCommerce Plugins Need Patching
An RCE, an auth bypass, and an arbitrary file deletion in three WooCommerce plugins this week. All rated CVSS 9.1 or higher. Patch all three now.
Four WordPress Plugins at CVSS 9.8: Auth Bypass Persists
Four critical authentication bypass flaws in WordPress plugins this week affect a mobile app builder, a JSON auth module, a developer toolkit, and a membership system.
Critical File Upload Bug in WooCommerce Quote Plugin
CVE-2026-18143 is a CVSS 9.8 arbitrary file upload flaw in the Request a Quote for WooCommerce plugin through version 2.9.2. Update to 2.9.3.
Elementor CSRF Flaw Lets Attackers Create Admin Accounts
A CSRF flaw in the Elementor WordPress plugin lets attackers create administrator accounts without valid credentials. Site owners should update the plugin immediately.
WordPress Core RCE Flaw CVE-2026-87902 Under Active Exploit
WordPress core path traversal CVE-2026-87902 allows unauthenticated RCE under specific conditions. Exploitation confirmed within 24 hours. CVSS 8.1 High.
WordPress Core XSS Flaw Enables RCE via Admin Sessions
Stored XSS in WordPress core lets anonymous visitors plant scripts in comments. An admin viewing the page can trigger remote code execution.
CVSS 10 Flaw in WordPress Payment Plugin Grants Admin Access
CVE-2026-81648 skips authorization on a CryptoPayment Gateway AJAX endpoint in versions 1.2.1-1.2.2, giving unauthenticated visitors admin-level access.
Events Calendar Plugin: Two CVSS 9.8 RCEs
Two unauthenticated CVSS 9.8 RCEs in The Events Calendar WordPress plugin affect all versions through 6.17.4. Disable or update immediately.
Frontend Admin Plugin Flaw Allows WordPress Account Takeover
CVE-2026-75816, scored CVSS 9.8, is an authentication bypass in the Frontend Admin by DynamiApps plugin that allows unauthenticated takeover of any WordPress account on affected sites.
All-in-One WP Migration Flaw Hits 3M WordPress Sites
Unauthenticated SQL injection in All-in-One WP Migration and Backup plugin (versions through 7.109) enables data theft and conditional RCE. Update immediately.
Elementor Pro Flaw Exploited to Backdoor WordPress Sites
Attackers are exploiting CVE-2026-32475, a critical file upload flaw in Elementor Pro, to deliver webshells to WordPress sites running version 4.2.1 or earlier.
Profile Builder Plugin Flaw Allows Unauth File Upload
Cozmoslabs Profile Builder for WordPress up to 3.16.1 lets unauthenticated attackers upload files via the avatar AJAX endpoint. Patch or mitigate now.
Avada WordPress Theme Patches Critical Zero-Click RCE
ThemeFusion patches a six-flaw chain in Avada and Fusion Builder that lets unauthenticated attackers execute arbitrary PHP code. CVSS 9.8 Critical.
miniOrange SAML WordPress Flaws Under Active Exploit
Two authentication bypass flaws in the miniOrange SAML 2.0 SSO plugin are being actively exploited for WordPress admin takeover. Update immediately.
Forminator WordPress Plugin RCE Flaw Hits 600K Sites
CVE-2026-15748 (CVSS 9.8) in Forminator Forms lets unauthenticated attackers upload PHP files and achieve remote code execution. Update immediately.
Critical Flaws in Pods, Link Library Hit WordPress Sites
Pods (CVSS 9.8) and Link Library (CVSS 9.1) expose WordPress sites to unauthenticated privilege escalation and arbitrary file deletion with RCE potential.
MaxUpload for WordPress: Unauthenticated File Upload
CVE-2026-15965: MaxUpload (≤1.4.0) lets unauthenticated attackers upload arbitrary files via a filename validation mismatch between chunk and final assembly. CVSS 8.8, no patch confirmed.
Patch Now: Critical Auth Bypass Hits WordPress Plugins
Two WordPress plugins patched this week carry CVSS 9.8 authentication bypass flaws. A third allows unauthenticated file deletion that hands attackers RCE.
WordPress 7.0.4 Patches High-Severity RCE Flaw
WordPress 7.0.4 fixes a high-severity RCE allowing Author-level accounts to execute code via malicious PostScript files. Update now.
Three CVEs Chain to Admin Takeover in WordPress Login Plugin
Three CVEs in the Login & Register Forms WordPress plugin before 4.0.2 enable unauthenticated account takeover, including site admins. Update now.
Both wp2shell CVEs land on CISA KEV — federal clock runs
CISA added both wp2shell CVEs — CVE-2026-63030 RCE and CVE-2026-60137 SQLi — to KEV on July 21. BOD 26-04 clock runs; SQLi is now framed as chainable.
wp2shell mass scanning confirmed — patch triage tonight
Four vendors — KEVIntel, watchTowr, Wiz, Cloudflare — now confirm mass scanning of the wp2shell RCE. CMSmap webshells and backdoor admin accounts observed.
wp2shell: first signs of exploitation; CVE-2026-60137 lands
watchTowr reports first signs of in-the-wild exploitation of the WordPress Core wp2shell RCE. The pending companion CVE-2026-60137 SQLi has landed, and exact patched versions are 6.9.5 and 7.0.2.
WordPress Core RCE (wp2shell): CVE-2026-63030, PoC public
A critical unauthenticated remote code execution flaw in WordPress Core got a CVE, a GitHub advisory, and a working public PoC on July 17, 2026.