WordPress Vulnerability
18
Guides
Tutor LMS <= 4.0.7 - Subscriber+ PHP Object Injection to RCE (CVE-2026-78175)
CVE-2026-78175 allows subscriber-level attackers to reach PHP Object Injection and remote code execution in Tutor LMS 4.0.7 and earlier. Update to 4.0.8 or later.
WordPress Core <= 7.1 - 11 Security Fixes Including Stored XSS and Click2Shell
WordPress 7.1.1 fixes 11 security issues, including CVE-2026-93485 stored XSS and the Click2Shell crafted-URL chain. Update WordPress Core immediately.
How to Perform VAPT Penetration Testing on Your WordPress Site
VAPT has two parts: vulnerability assessment and penetration testing. Most WordPress owners can automate the assessment phase, then reserve manual testing for the risks that actually matter.
WordPress Importer — Arbitrary Post Creation
The official WordPress Importer accepts a structured file and creates content from it. WPDeeply’s 2021 disclosure examined what happens when the file is not trustworthy.
WordPress $wpdb->prepare(), Denial of Service, and Memory Limits
The practical risk is not that every use of $wpdb->prepare() is dangerous. The risk is that database helper code can become a denial-of-service path when untrusted input creates…
Abandoned Cart Lite for WooCommerce before 5.8.2 — SQL Injection
Unsanitised cart parameters in Abandoned Cart Lite for WooCommerce exposed stored customer data to unauthenticated extraction. Fixed in 5.8.3.
Loginizer before 1.6.4 — Unauthenticated SQL Injection
An unauthenticated SQL injection in Loginizer’s brute-force protection, reachable from any WordPress login form. Fixed in 1.6.4 — and pushed to over a million sites by a rare…
Ninja Forms before 3.4.27.1 — Simple CSRF to RCE
A missing request-origin check in Ninja Forms let one crafted link, clicked by a logged-in administrator, escalate into code execution. Fixed in 3.4.27.1.
WooCommerce before 4.1.0 — Remote Code Execution
A security fix that reached millions of stores through a changelog line reading like routine maintenance — and the ecosystem of plugins that copied the original code.
WordPress Protected Meta Exposure via WP Job Manager: What Site Owners Should Know
Protected meta is only protected if every plugin respects the boundary. Job, listing, and directory plugins often attach sensitive operational data to posts, so permission checks matter.