Security Research
Historical and current WordPress vulnerability disclosures.
79
Guides
Contact Form 7 6.2-6.2.3 – Unauthenticated Arbitrary File Upload
Contact Form 7 6.2-6.2.3 allows unauthenticated arbitrary file uploads under specific form and server conditions. Update to 6.2.4.1 and inspect the temporary upload directory.
Gravity Forms <= 3.1.2 - Actively Exploited Unauthenticated PHP Object Injection (CVE-2026-103039)
Gravity Forms 3.1.2 and earlier are vulnerable to unauthenticated PHP object injection through a List-type Post Custom Field. Patchstack marks CVE-2026-103039 as known exploited; update to 3.1.3 or…
WordPress Core < 7.1.4 - Unauthenticated Upgrade-Window RCE Under Active Attack
WordPress Core before 7.1.4 contains a high-severity unauthenticated race condition in the core update process. Automated exploitation attempts began shortly after release; update and block public access to…
Checkout Files Upload for WooCommerce before 2.4.0 – Actively Exploited File Upload (CVE-2026-103688)
Checkout Files Upload for WooCommerce versions earlier than 2.4.0 contain a critical unauthenticated arbitrary file upload vulnerability tracked as CVE-2026-103688. Patchstack lists the flaw as actively exploited and…
YOOtheme Pro 5.0.0-5.0.52 – Actively Exploited Unauthenticated File Upload (CVE-2026-102785)
YOOtheme Pro versions 5.0.0 through 5.0.52 contain a critical unauthenticated arbitrary file upload vulnerability tracked as CVE-2026-102785. Wordfence reports blocking 1,002 attacks in a 24-hour period. Update the…
Pie Register Premium through 3.8.4.0 – Actively Exploited Unauthenticated File Upload (CVE-2026-84999)
Pie Register Premium versions 3.8.4.0 and earlier contain a critical unauthenticated arbitrary file upload vulnerability tracked as CVE-2026-84999. Patchstack lists the flaw as actively exploited. Update to 3.8.4.1…
Prime Mover through 2.2.1 – Unauthenticated PHP Object Injection (CVE-2026-115806)
Prime Mover – Backup and Migration versions 2.2.1 and earlier contain a critical unauthenticated PHP object injection vulnerability tracked as CVE-2026-115806. The issue is rated CVSS 9.8. Update…
Newsletters <= 4.18.1 - Unauthenticated Object Injection and SQL Injection
Newsletters versions through 4.18.1 contain critical unauthenticated PHP object injection and SQL injection vulnerabilities. Update to 4.18.2 or later.
Product Filter by WBW <= 3.4.6 - Unauthenticated Blind SQL Injection (CVE-2026-112866)
Product Filter for WooCommerce by WBW versions through 3.4.6 contain a critical unauthenticated blind SQL injection. Update to 3.4.7 or later and review frontend filter traffic.
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS (CVE-2026-113499, CVE-2026-113500)
LiteSpeed Cache versions before 7.9.2 contain two unauthenticated stored XSS vulnerabilities affecting specific CDN and font optimization configurations. Update immediately and purge cached pages.