WordPress Security Guides
WordPress vulnerability news, plugin removals and security releases.
125
Guides
07
Topics
Timely WordPress security coverage: newly disclosed vulnerabilities, plugins pulled from the directory, important security releases and monthly roundups. Evergreen how-to material lives in security guides instead.
Checkout Files Upload for WooCommerce before 2.4.0 – Actively Exploited File Upload (CVE-2026-103688)
Checkout Files Upload for WooCommerce versions earlier than 2.4.0 contain a critical unauthenticated arbitrary file upload vulnerability tracked as CVE-2026-103688. Patchstack lists the flaw as actively exploited and…
YOOtheme Pro 5.0.0-5.0.52 – Actively Exploited Unauthenticated File Upload (CVE-2026-102785)
YOOtheme Pro versions 5.0.0 through 5.0.52 contain a critical unauthenticated arbitrary file upload vulnerability tracked as CVE-2026-102785. Wordfence reports blocking 1,002 attacks in a 24-hour period. Update the…
Pie Register Premium through 3.8.4.0 – Actively Exploited Unauthenticated File Upload (CVE-2026-84999)
Pie Register Premium versions 3.8.4.0 and earlier contain a critical unauthenticated arbitrary file upload vulnerability tracked as CVE-2026-84999. Patchstack lists the flaw as actively exploited. Update to 3.8.4.1…
Prime Mover through 2.2.1 – Unauthenticated PHP Object Injection (CVE-2026-115806)
Prime Mover – Backup and Migration versions 2.2.1 and earlier contain a critical unauthenticated PHP object injection vulnerability tracked as CVE-2026-115806. The issue is rated CVSS 9.8. Update…
Newsletters <= 4.18.1 - Unauthenticated Object Injection and SQL Injection
Newsletters versions through 4.18.1 contain critical unauthenticated PHP object injection and SQL injection vulnerabilities. Update to 4.18.2 or later.
Product Filter by WBW <= 3.4.6 - Unauthenticated Blind SQL Injection (CVE-2026-112866)
Product Filter for WooCommerce by WBW versions through 3.4.6 contain a critical unauthenticated blind SQL injection. Update to 3.4.7 or later and review frontend filter traffic.
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS (CVE-2026-113499, CVE-2026-113500)
LiteSpeed Cache versions before 7.9.2 contain two unauthenticated stored XSS vulnerabilities affecting specific CDN and font optimization configurations. Update immediately and purge cached pages.
PHP 8.2-8.5 – Critical Unauthenticated RCE (CVE-2026-109618, CVE-2026-109619)
CVE-2026-109618 and CVE-2026-109619 are critical unauthenticated PHP RCE flaws affecting WordPress servers. Update to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a vendor-confirmed patched package, then restart PHP.
Duplicator <= 1.5.17 / Pro <= 4.6.10 - Unauthenticated PHP Object Injection
CVE-2026-82814 is a high-severity unauthenticated PHP object injection affecting Duplicator Free
UpdraftCentral Cloud Key Compromise – Signed Commands Install Malicious WordPress Plugins
Active attacks used compromised UpdraftCentral Cloud connection keys to send signed commands and install malicious WordPress plugins. Update to 1.26.13/2.26.13 or later, revoke all keys, and hunt for…
Kirki up to 6.3.2 – Unauthenticated Sensitive User Data Exposure (CVE-2026-107762)
Kirki through 6.3.2 can expose user profile data through an unauthenticated frontend REST authorization bypass. Update to 6.4.0 or later.
LearnPress up to 4.4.10 – Unauthenticated PHP Object Injection (CVE-2026-104736)
LearnPress through 4.4.10 is vulnerable to critical unauthenticated PHP object injection in checkout session handling. Update to 4.4.11 or later.