WPdeeply

WPDeeply is the site's editorial account for WordPress security advisories, plugin risk research, and remediation guides. Articles under this byline are checked against vendor changelogs, CVE records, vulnerability database entries, and the WPDeeply editorial policy before publication.

wpdeeply.com All posts by this author

92 published guides

Checkout Files Upload for WooCommerce before 2.4.0 – Actively Exploited File Upload (CVE-2026-103688) Checkout Files Upload for WooCommerce versions earlier than 2.4.0 contain a critical unauthenticated arbitrary file upload vulnerability tracked as CVE-2026-103688. Patchstack lists the flaw as actively exploited and… Plugin Security 29 Oct 2026, 3 min YOOtheme Pro 5.0.0-5.0.52 – Actively Exploited Unauthenticated File Upload (CVE-2026-102785) YOOtheme Pro versions 5.0.0 through 5.0.52 contain a critical unauthenticated arbitrary file upload vulnerability tracked as CVE-2026-102785. Wordfence reports blocking 1,002 attacks in a 24-hour period. Update the… Plugin Security 28 Oct 2026, 3 min Pie Register Premium through 3.8.4.0 – Actively Exploited Unauthenticated File Upload (CVE-2026-84999) Pie Register Premium versions 3.8.4.0 and earlier contain a critical unauthenticated arbitrary file upload vulnerability tracked as CVE-2026-84999. Patchstack lists the flaw as actively exploited. Update to 3.8.4.1… Plugin Security 28 Oct 2026, 3 min Prime Mover through 2.2.1 – Unauthenticated PHP Object Injection (CVE-2026-115806) Prime Mover – Backup and Migration versions 2.2.1 and earlier contain a critical unauthenticated PHP object injection vulnerability tracked as CVE-2026-115806. The issue is rated CVSS 9.8. Update… Plugin Security 27 Oct 2026, 3 min Newsletters <= 4.18.1 - Unauthenticated Object Injection and SQL Injection Newsletters versions through 4.18.1 contain critical unauthenticated PHP object injection and SQL injection vulnerabilities. Update to 4.18.2 or later. Plugin Security 25 Oct 2026, 3 min Product Filter by WBW <= 3.4.6 - Unauthenticated Blind SQL Injection (CVE-2026-112866) Product Filter for WooCommerce by WBW versions through 3.4.6 contain a critical unauthenticated blind SQL injection. Update to 3.4.7 or later and review frontend filter traffic. Plugin Security 25 Oct 2026, 2 min LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS (CVE-2026-113499, CVE-2026-113500) LiteSpeed Cache versions before 7.9.2 contain two unauthenticated stored XSS vulnerabilities affecting specific CDN and font optimization configurations. Update immediately and purge cached pages. Plugin Security 24 Oct 2026, 3 min PHP 8.2-8.5 – Critical Unauthenticated RCE (CVE-2026-109618, CVE-2026-109619) CVE-2026-109618 and CVE-2026-109619 are critical unauthenticated PHP RCE flaws affecting WordPress servers. Update to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a vendor-confirmed patched package, then restart PHP. Plugin Security 22 Oct 2026, 4 min Duplicator <= 1.5.17 / Pro <= 4.6.10 - Unauthenticated PHP Object Injection CVE-2026-82814 is a high-severity unauthenticated PHP object injection affecting Duplicator Free Plugin Security 21 Oct 2026, 4 min UpdraftCentral Cloud Key Compromise – Signed Commands Install Malicious WordPress Plugins Active attacks used compromised UpdraftCentral Cloud connection keys to send signed commands and install malicious WordPress plugins. Update to 1.26.13/2.26.13 or later, revoke all keys, and hunt for… Plugin Security 20 Oct 2026, 4 min