Tag
6posts tagged #plugin.
A capability-mapping bug in Events Manager lets an unauthenticated visitor take over any admin account whose user ID matches one of the plugin's records, and four other WordPress plugins shipped critical fixes for RCE and payment-bypass holes.
WordPress 7.0.4 patches an author-level Imagick RCE that smuggles its payload inside a PNG, and five plugin criticals land on NVD — most of them pre-auth.
A supply-chain compromise in the BdThemes plugin ecosystem is pushing malicious payloads through a poisoned update API response, reaching sites that never installed anything new.
WordPress 7.0.3 fixes a pre-authentication reflected XSS on the login screen. A hardcoded backdoor shipped in one Advanced Responsive Video Embedder release, and The Events Calendar patched an author-level file read.
Segurium is live on the official WordPress.org plugin directory: malware detection, precise cleanup, and hardening for WordPress. Free to install — search for Segurium under Plugins → Add New. Requires WordPress 6.2+ and PHP 7.4+.
Historical note: early Segurium builds were hosted on segurium.com while the WordPress.org review was in progress. The plugin is now live in the official directory — install it from wordpress.org/plugins/segurium.
