WPDeeply
Download free plugin

Security Research

Historical and current WordPress vulnerability disclosures.

79
Guides
All 128 Plugin Security 83 Security Research 79 Vulnerability Types 11 Hardening 10 Security News 7 Malware 5 WordPress Insights 4 RSS
PHP 8.2-8.5 – Critical Unauthenticated RCE (CVE-2026-109618, CVE-2026-109619) CVE-2026-109618 and CVE-2026-109619 are critical unauthenticated PHP RCE flaws affecting WordPress servers. Update to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a vendor-confirmed patched package, then restart PHP. Plugin Security 22 Oct 2026, 4 min Duplicator <= 1.5.17 / Pro <= 4.6.10 - Unauthenticated PHP Object Injection CVE-2026-82814 is a high-severity unauthenticated PHP object injection affecting Duplicator Free Plugin Security 21 Oct 2026, 4 min UpdraftCentral Cloud Key Compromise – Signed Commands Install Malicious WordPress Plugins Active attacks used compromised UpdraftCentral Cloud connection keys to send signed commands and install malicious WordPress plugins. Update to 1.26.13/2.26.13 or later, revoke all keys, and hunt for… Plugin Security 20 Oct 2026, 4 min Kirki up to 6.3.2 – Unauthenticated Sensitive User Data Exposure (CVE-2026-107762) Kirki through 6.3.2 can expose user profile data through an unauthenticated frontend REST authorization bypass. Update to 6.4.0 or later. Plugin Security 19 Oct 2026, 3 min LearnPress up to 4.4.10 – Unauthenticated PHP Object Injection (CVE-2026-104736) LearnPress through 4.4.10 is vulnerable to critical unauthenticated PHP object injection in checkout session handling. Update to 4.4.11 or later. Plugin Security 18 Oct 2026, 3 min Backuply up to 1.5.8 – Subscriber+ Second-Order SQL Injection (CVE-2026-93953) Backuply through 1.5.8 is vulnerable to subscriber-level second-order SQL injection during restore. Update to 1.5.9 and review registration settings. Plugin Security 17 Oct 2026, 3 min Rank Math SEO PRO 3.0.123 – Supply-Chain Malware (CVE-2026-111862) A subset of Rank Math SEO PRO 3.0.123 packages contained supply-chain malware. Check the affected window, IOCs, and recovery steps for CVE-2026-111862. Plugin Security 17 Oct 2026, 3 min FunnelKit up to 3.16.0.5 – Exploited Unauthenticated Stored XSS (CVE-2026-100147) FunnelKit versions through 3.16.0.5 contain an unauthenticated stored cross-site scripting vulnerability in WooCommerce order fields. CVE-2026-100147 has a CVSS score of 7.2 in the Wordfence record, and Patchstack… Plugin Security 15 Oct 2026, 3 min 10Web Booster up to 2.34.10 – Unauthenticated Arbitrary File Upload (CVE-2026-108587) 10Web Booster versions through 2.34.10 contain a critical unauthenticated arbitrary file upload vulnerability that can lead to remote code execution. CVE-2026-108587 has a CVSS score of 9.8. The… Plugin Security 15 Oct 2026, 3 min ShopMagic up to 4.9.0 – Unauthenticated Local File Inclusion (CVE-2026-103367) ShopMagic versions through 4.9.0 contain a high-severity local file inclusion vulnerability that can allow an unauthenticated attacker to include and execute a PHP file already present on the… Plugin Security 14 Oct 2026, 3 min