Segurium's writing on WordPress malware patterns, cleanup playbooks, and engineering deep-dives.https://segurium.com/en-ushttps://segurium.com/blog/2026-08-13-events-manager-takeover-and-four-other-critical-plugin-patches/https://segurium.com/blog/2026-08-13-events-manager-takeover-and-four-other-critical-plugin-patches/A capability-mapping bug in Events Manager lets an unauthenticated visitor take over any admin account whose user ID matches one of the plugin's records, and four other WordPress plugins shipped critical fixes for RCE and payment-bypass holes.Thu, 13 Aug 2026 00:00:00 GMTwordpressplugincvepress@segurium.com (Segurium)https://segurium.com/blog/2026-08-12-a-wordpress-core-rce-hiding-inside-a-png-upload/https://segurium.com/blog/2026-08-12-a-wordpress-core-rce-hiding-inside-a-png-upload/WordPress 7.0.4 patches an author-level Imagick RCE that smuggles its payload inside a PNG, and five plugin criticals land on NVD — most of them pre-auth.Wed, 12 Aug 2026 00:00:00 GMTwordpressplugincvepress@segurium.com (Segurium)https://segurium.com/blog/2026-08-09-bdthemes-ecosystem-hit-by-a-poisoned-api-response/https://segurium.com/blog/2026-08-09-bdthemes-ecosystem-hit-by-a-poisoned-api-response/A supply-chain compromise in the BdThemes plugin ecosystem is pushing malicious payloads through a poisoned update API response, reaching sites that never installed anything new.Sun, 09 Aug 2026 00:00:00 GMTwordpresspluginsupply-chainmalwarepress@segurium.com (Segurium)https://segurium.com/blog/2026-08-08-a-login-screen-xss-in-wordpress-7-0-3-and-a-plugin-backdoor/https://segurium.com/blog/2026-08-08-a-login-screen-xss-in-wordpress-7-0-3-and-a-plugin-backdoor/WordPress 7.0.3 fixes a pre-authentication reflected XSS on the login screen. A hardcoded backdoor shipped in one Advanced Responsive Video Embedder release, and The Events Calendar patched an author-level file read.Sat, 08 Aug 2026 00:00:00 GMTwordpresscvepluginexploitpress@segurium.com (Segurium)https://segurium.com/blog/2026-08-05-segurium-1-0-0-on-wordpress-org/https://segurium.com/blog/2026-08-05-segurium-1-0-0-on-wordpress-org/Segurium is live on the official WordPress.org plugin directory: malware detection, precise cleanup, and hardening for WordPress. Free to install — search for Segurium under Plugins → Add New. Requires WordPress 6.2+ and PHP 7.4+.Wed, 05 Aug 2026 00:00:00 GMTreleasepluginpress@segurium.com (Segurium)https://segurium.com/blog/2026-05-28-segurium-0-1-3-direct-download/https://segurium.com/blog/2026-05-28-segurium-0-1-3-direct-download/Historical note: early Segurium builds were hosted on segurium.com while the WordPress.org review was in progress. The plugin is now live in the official directory — install it from wordpress.org/plugins/segurium.Thu, 28 May 2026 00:00:00 GMTreleasepluginpress@segurium.com (Segurium)https://segurium.com/blog/tester-program-100-pro-licenses/https://segurium.com/blog/tester-program-100-pro-licenses/We are opening a small tester program for Segurium. 100 WordPress admins get a 1-year Pro license in exchange for real-world feedback from staging or low-risk production sites.Fri, 15 May 2026 00:00:00 GMTtester-programpress@segurium.com (Segurium)https://segurium.com/blog/cleanup-without-breaking-your-site/https://segurium.com/blog/cleanup-without-breaking-your-site/How Segurium restores tampered WordPress core, plugin, and theme files to canonical upstream content — and why most cleanups don't have to be wipe-and-pray.Sun, 12 Apr 2026 00:00:00 GMTproductcleanuppress@segurium.com (Segurium)