WPdeeply

WPDeeply is the site's editorial account for WordPress security advisories, plugin risk research, and remediation guides. Articles under this byline are checked against vendor changelogs, CVE records, vulnerability database entries, and the WPDeeply editorial policy before publication.

wpdeeply.com All posts by this author

92 published guides

Kirki up to 6.3.2 – Unauthenticated Sensitive User Data Exposure (CVE-2026-107762) Kirki through 6.3.2 can expose user profile data through an unauthenticated frontend REST authorization bypass. Update to 6.4.0 or later. Plugin Security 19 Oct 2026, 3 min LearnPress up to 4.4.10 – Unauthenticated PHP Object Injection (CVE-2026-104736) LearnPress through 4.4.10 is vulnerable to critical unauthenticated PHP object injection in checkout session handling. Update to 4.4.11 or later. Plugin Security 18 Oct 2026, 3 min Backuply up to 1.5.8 – Subscriber+ Second-Order SQL Injection (CVE-2026-93953) Backuply through 1.5.8 is vulnerable to subscriber-level second-order SQL injection during restore. Update to 1.5.9 and review registration settings. Plugin Security 17 Oct 2026, 3 min Rank Math SEO PRO 3.0.123 – Supply-Chain Malware (CVE-2026-111862) A subset of Rank Math SEO PRO 3.0.123 packages contained supply-chain malware. Check the affected window, IOCs, and recovery steps for CVE-2026-111862. Plugin Security 17 Oct 2026, 3 min FunnelKit up to 3.16.0.5 – Exploited Unauthenticated Stored XSS (CVE-2026-100147) FunnelKit versions through 3.16.0.5 contain an unauthenticated stored cross-site scripting vulnerability in WooCommerce order fields. CVE-2026-100147 has a CVSS score of 7.2 in the Wordfence record, and Patchstack… Plugin Security 15 Oct 2026, 3 min 10Web Booster up to 2.34.10 – Unauthenticated Arbitrary File Upload (CVE-2026-108587) 10Web Booster versions through 2.34.10 contain a critical unauthenticated arbitrary file upload vulnerability that can lead to remote code execution. CVE-2026-108587 has a CVSS score of 9.8. The… Plugin Security 15 Oct 2026, 3 min ShopMagic up to 4.9.0 – Unauthenticated Local File Inclusion (CVE-2026-103367) ShopMagic versions through 4.9.0 contain a high-severity local file inclusion vulnerability that can allow an unauthenticated attacker to include and execute a PHP file already present on the… Plugin Security 14 Oct 2026, 3 min SimpleForm up to 3.10.0 – Unauthenticated Administrator Account Creation (CVE-2026-104748) SimpleForm versions through 3.10.0 contain a critical unauthenticated privilege-escalation vulnerability that can let a remote attacker create a WordPress user with Administrator capabilities. Wordfence assigned CVE-2026-104748 a CVSS… Plugin Security 14 Oct 2026, 3 min Divi Plus up to 2.4.0 – Unauthenticated Arbitrary File Read (CVE-2026-91136) CVE-2026-91136 lets unauthenticated attackers read server files through a Divi Plus REST endpoint. Update to version 2.4.1 immediately. Plugin Security 13 Oct 2026, 3 min Ghostscript 9.21-10.07.1 – Unauthenticated RCE Risk via WordPress PDF Previews (CVE-2026-39919) CVE-2026-39919 can turn WordPress PDF preview processing into build-specific remote code execution on servers using vulnerable Ghostscript packages. Plugin Security 13 Oct 2026, 4 min