WPdeeply
92 published guides
Ultra Addons for Contact Form 7 ≤ 3.5.50 – Unauthenticated Arbitrary File Upload
CVE-2026-82901 is a critical unauthenticated arbitrary file upload vulnerability in Ultra Addons for Contact Form 7 ≤ 3.5.50 when the PDF Generator module is enabled. Update to 3.5.51…
miniOrange OTP Login ≤ 5.5.5 – Unauthenticated Administrator Login Bypass
CVE-2026-85984 can let unauthenticated attackers take over administrator accounts on miniOrange OTP Login 5.5.5 and earlier under a vulnerable settings combination. Update to 5.5.6.
Elementor 4.3.0-4.3.1 – REST Nonce Bypass to Privilege Escalation
CVE-2026-62062 lets a crafted link bypass REST nonce validation in Elementor 4.3.0 and 4.3.1, enabling actions permitted to a logged-in victim. Update to 4.3.2.
s2Member ≤ 260814 – Unauthenticated Remote Code Execution
CVE-2026-19804 allows unauthenticated remote code execution on specifically configured s2Member sites running version 260814 or earlier. Update to 260829 or newer.
YOP Poll <= 7.0.10 - Administrator Account Takeover via postMessage Origin Validation (CVE-2026-85682)
YOP Poll 7.0.10 and earlier can expose an administrator REST nonce through unsafe postMessage origin handling. Update to 7.0.11 or later and review administrator accounts.
Visual Composer <= 45.16.0 - Unauthenticated Local File Inclusion (CVE-2026-12227)
Visual Composer Website Builder 45.16.0 and earlier permits unauthenticated local file inclusion through the vcv-template parameter. Update to 45.16.1 or later immediately.
HUSKY <= 1.4.4 - Unauthenticated Local File Inclusion (CVE-2026-92969)
HUSKY Products Filter for WooCommerce 1.4.4 and earlier permits unauthenticated local PHP file inclusion through its AJAX product rendering path. Update to 1.4.5 or later.
WordPress Core <= 7.1.1 - Unauthenticated Path Traversal and Local File Inclusion (CVE-2026-87902)
WordPress Core through 7.1.1 contains an unauthenticated template path-traversal flaw that can include local PHP files and lead to RCE on compatible theme/server configurations. Update to 7.1.2 or…
11 Secure WordPress Development Best Practices to Prevent CVEs
Most WordPress CVEs are not mysterious. They come from trusting input, skipping capability checks, forgetting nonces, unsafe SQL, unsafe output, or file handling that assumes too much.
Forminator Forms <= 1.57.2 - Unauthenticated Shortcode Execution (CVE-2026-92229)
Forminator Forms 1.57.2 and earlier can process untrusted current_url input as WordPress shortcodes. Update to 1.57.3 or later and review exposed forms and logs.