Category
What is being exploited in the WordPress ecosystem right now, and what it takes to be safe from it.
WP Compress ships version 7.20.01 to close a maximum-severity RCE that needs no login. Four other WordPress plugins carry critical bugs the same day, with two PHP object injections, one SQL injection, and one subscriber-level takeover.
WordPress 7.0.4 fixes an author-level remote code execution through Imagick's PostScript handling. Forminator 1.56.2 closes an unauthenticated arbitrary file upload on roughly 600,000 sites, and WPAdverts 2.3.3 patches an authorization bypass in its REST endpoint.
A missing capability check in Frontend Admin by DynamiApps lets unauthenticated visitors escalate to administrator through a non-numeric user ID; update to 3.29.10 and audit accounts before other criticals in ProSolution WP Client, Solace Extra and ARForms.
An unauthenticated authorization bypass in Pods hands full admin to anyone who can reach the AJAX endpoint, and Templately's remote code execution needs only a subscriber account to fire.
Three unauthenticated authentication-bypass flaws in WordPress plugins were disclosed on the same day. Only User Profile Builder has shipped a fix; the other two remain open, alongside a critical file-deletion bug and two privilege-escalation flaws.
The link-factory plugin ships an operator-controlled REST API authenticated by a hardcoded Ed25519 key, and W3 Total Cache patches a stored XSS reachable through comment author names when its Lazy Load feature is enabled.
A capability-mapping bug in Events Manager lets an unauthenticated visitor take over any admin account whose user ID matches one of the plugin's records, and four other WordPress plugins shipped critical fixes for RCE and payment-bypass holes.
WordPress 7.0.4 patches an author-level Imagick RCE that smuggles its payload inside a PNG, and five plugin criticals land on NVD — most of them pre-auth.
A supply-chain compromise in the BdThemes plugin ecosystem is pushing malicious payloads through a poisoned update API response, reaching sites that never installed anything new.
WordPress 7.0.3 fixes a pre-authentication reflected XSS on the login screen. A hardcoded backdoor shipped in one Advanced Responsive Video Embedder release, and The Events Calendar patched an author-level file read.
