WPDeeply
Download free plugin

Security Research

Historical and current WordPress vulnerability disclosures.

36
Guides
All 84 Plugin Security 40 Security Research 36 Vulnerability Types 11 Hardening 9 Security News 7 Malware 5 WordPress Insights 4 RSS
Tutor LMS <= 4.0.7 - Subscriber+ PHP Object Injection to RCE (CVE-2026-78175) CVE-2026-78175 allows subscriber-level attackers to reach PHP Object Injection and remote code execution in Tutor LMS 4.0.7 and earlier. Update to 4.0.8 or later. Plugin Security 19 Sep 2026, 4 min WordPress Core <= 7.1 - 11 Security Fixes Including Stored XSS and Click2Shell WordPress 7.1.1 fixes 11 security issues, including CVE-2026-93485 stored XSS and the Click2Shell crafted-URL chain. Update WordPress Core immediately. Security News 19 Sep 2026, 4 min How to Perform VAPT Penetration Testing on Your WordPress Site VAPT has two parts: vulnerability assessment and penetration testing. Most WordPress owners can automate the assessment phase, then reserve manual testing for the risks that actually matter. Security Research 19 Sep 2026, 2 min Multi Uploader for Gravity Forms <= 1.1.9 - Unauthenticated Arbitrary File Upload CVE-2026-87796 is a critical unauthenticated arbitrary file upload in Multi Uploader for Gravity Forms 1.1.9 and earlier. No patched release is known; deactivate the plugin and investigate uploads. Plugin Security 17 Sep 2026, 3 min All-in-One WP Migration and Backup <= 7.110 - Unauthenticated Credential Storage via Basic Auth Header CVE-2026-89064 affects All-in-One WP Migration and Backup 7.110 and earlier. Update to 7.111 and review exposed authentication workflows. Plugin Security 17 Sep 2026, 3 min WooCommerce Wholesale Lead Capture <= 2.0.3.1 - Active Exploitation of Unauthenticated File Upload RCE Active attacks are exploiting an unauthenticated file upload flaw in WooCommerce Wholesale Lead Capture 2.0.3.1 and earlier. Update to 2.0.3.2 and investigate for PHP webshells. Plugin Security 16 Sep 2026, 4 min The Events Calendar <= 6.17.4 - Unauthenticated RCE via Widget Instance Handling CVE-2026-78006 and CVE-2026-78159 affect The Events Calendar. Update to 6.17.4.1 or later immediately. Plugin Security 13 Sep 2026, 3 min Drag and Drop File Upload for Elementor Forms <= 1.6.0 - Unauthenticated Arbitrary File Upload CVE-2026-18351 affects Drag and Drop File Upload for Elementor Forms up to version 1.6.0. Unauthenticated attackers may upload dangerous file types through weak validation. Update to 1.6.1 or… Plugin Security 10 Sep 2026, 2 min SureCart < 4.6.3 - Subscriber Account Takeover via Customer Update Access Control Flaw CVE-2026-18480 affects SureCart before 4.6.3. A subscriber-level user can change another user's email address, including an administrator account, and trigger account takeover through password reset. Update SureCart to… Plugin Security 8 Sep 2026, 4 min MStore API <= 4.20.0 - Unauthenticated Authentication Bypass via Firebase JWT Forgery CVE-2026-13447 affects MStore API Plugin Security 6 Sep 2026, 1 min