Elementor Pro 4.2.2 fixes a file-upload flaw under active attack
Attackers are exploiting a critical file-upload flaw in Elementor Pro 4.2.1 and earlier. Elementor shipped 4.2.2 as the fix. The CVSS is 9 and no login is needed.
Blog
Patterns, playbooks, deep-dives.
Notes from cleaning up infected WordPress sites — what gets injected, why the obvious fix fails, and how we keep cleanups precise enough that the site has no downtime afterwards.
All-in-One WP Migration 7.110 and Gravity Forms 3.0.3 patch RCE paths
Two WordPress plugins on roughly six million sites shipped fixes for unauthenticated RCE paths: All-in-One WP Migration via second-order SQL injection, Gravity Forms via a file upload that runs on NGINX.
GiveWP 4.16.7.2 patches a critical unauthenticated RCE
GiveWP shipped 4.16.7.2 for an unauthenticated PHP object-injection RCE with a CVSS of 10. The Events Calendar patched a similar bug in 6.17.3.1. A WPMU DEV Dashboard auth bypass has no fix. An old Pods privilege escalation resurfaced in a news write-up.
MalCare 6.65 fixes an unauthenticated takeover on 200,000 sites
A weak random number generator in BlogVault, MalCare and WP Remote let attackers derive the secret that binds a site to the remote management service and log in as administrator. Version 6.65 rebuilds the secret. Around 200,000 sites run the affected code.
Avada 7.16.1 patches an RCE, and two plugins leaked reset links
Avada 7.16.1 fixes an unauthenticated remote code execution chain that needed Fusion Builder active too. TranslatePress 3.3.2 and InfusedWoo Pro 5.1.18 both close holes that handed an administrator password reset link to an attacker.
miniOrange SAML SSO auth bypass moves from advisory to attack
Attackers are now targeting WordPress sites that still run miniOrange SAML SSO 5.4.4 or older. Five more plugin CVEs also arrived, four of them without a fix.
wp2shell: the complete guide to the WordPress core RCE
wp2shell is a pre-authentication remote code execution chain in WordPress core (CVE-2026-63030 and CVE-2026-60137). What it is, whether you are affected, how to tell if your site was already hacked, and how to clean it.
ManageWP Worker 4.9.37 closes a login-replay hole on 1,000,000 sites
ManageWP Worker fixes a signed login link anyone can replay to become admin. Four more plugins ship patches that let unauthenticated or low-level users become admin too.
Mailgun 2.2.2 patches a pre-auth SSRF on 80,000 WordPress sites
Mailgun for WordPress 2.2.2 fixes an unauthenticated SSRF triggered by a path traversal in form handlers. Four more plugin CVEs published the same day include three that let anyone sign in as admin, and one PHP object injection in WS Form.
miniOrange SAML SSO 5.4.5 stops an unauthenticated admin login
A loose boolean check in miniOrange SAML SSO let anyone sign in as an admin, and 5.4.5 fixes it. Other fixes cover a WooCommerce OTP token leak, a WPeMatico privilege escalation, an unauth RCE in a Contact Form 7 uploader, XSS in WPForms Pro, and a Dokan capability slip.
JSON Options gives admin to anyone, and four more plugin fixes
An unauthenticated action in JSON Options lets any visitor flip on user registration and set the default role to administrator. rtMedia, Events Made Easy and Depicter ship fixes; Persistent Login has none.
W3 Total Cache 2.10.5 stops a pre-auth write to any file
W3 Total Cache 2.10.5 blocks an unauthenticated write to any file on the server, including .htaccess. Broken Link Checker 2.4.12 closes a pre-auth RCE. Elementor Pro, TrueBooker and TabaPay Gateway also shipped critical fixes.
An unauthenticated RCE in WP Compress, patched in 7.20.01
WP Compress ships version 7.20.01 to close a maximum-severity RCE that needs no login. Four other WordPress plugins carry critical bugs the same day, with two PHP object injections, one SQL injection, and one subscriber-level takeover.