WP Duplicate vulnerability CVE-2026-123751 is exploited in the wild, letting attackers upload files and run code. No patch exists, so remove the plugin.
Related Posts:
QNAP Warns NAS Users as Exploited Plex2Shell Vulnerabilities Hit Plex Media Server
PoC Published for Hugging Face Datasets RCE CVE-2026-57845 (CVSS 8.8) in Library With 38 Million Monthly Downloads
Openwave Webtop Media Transcoder Vulnerability CVE-2026-111793 Exploited in the Wild
The post WP Duplicate Vulnerability CVE-2026-1
WP Duplicate vulnerability CVE-2026-123751 is exploited in the wild, letting attackers upload files and run code. No patch exists, so remove the plugin.
Our weekly CVE report for Nov 2-8, 2026 tracks 3,570 new CVEs and 10 exploited vulnerabilities, including Siemens and Zyxel flaws not in CISA KEV.
Related Posts:
Weekly CVE Report Finds Oracle EBS, YOOtheme and FreeSWITCH Attacks Missing From CISA KEV
Weekly CVE Report Flags PHP2Shell and FortiSIEM Attacks Still Missing From CISA KEV
This Weekly CVE Report Finds CISA KEV Trailing Daily Cybersecurity by Up to 8 Days
The post Weekly CVE Report Finds Siemens, Zyxel and Sogou Attacks Missing From
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds WordPress flaw to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a WordPress flaw, tracked as CVE-2026-119977 (CVSS score of 8.1), to its Known Exploited Vulnerabilities (KEV) catalog.
CVE-2026-119977 is a high-severity remote code execution vulnerability affecting WordPress versions 4.7 through 7.1.3. It stems from predictable, web-accessible staging dire
CVE-2026-119977 is a high-severity remote code execution vulnerability affecting WordPress versions 4.7 through 7.1.3. It stems from predictable, web-accessible staging directories used during core updates.
Unauthenticated attackers could exploit a race condition to execute malicious code on the server while an update is in progress, potentially compromising the website. WordPress addressed the flaw in version 7.1.4.
Threat actors began scanning for CVE-2026-119977 shortly after WordPress released the security update. Wordfence recorded more than 18,500 requests targeting vulnerable staging installer paths within the first 21 hours. However, these figures document exploitation attempts, not confirmed successful compromises.
“Wordfence telemetry shows that threat actors are already actively attempting to exploit the vulnerability. The first match for our new firewall rule arrived nine minutes after deployment. During the first 21 hours, we recorded more than 18,500 requests targeting staged setup-config.php installer paths.” reads the report published by Wordfence.
“Two of the largest sources repeatedly polled small groups of sites for roughly 14.5 hours, behavior consistent with trying to catch the brief upgrade window. Other sources tested many staging-directory and version-name variations.”
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included a WordPress Core vulnerability in its Known Exploited Vulnerabilities catalog due to evidence of active exploitation. This vulnerability, identified as CVE-2026-119977, allows unauthenticated attackers to execute server-side code during a specific software upgrade window. CISA added this vulnerability to the catalog on November 3, 2026, […]
The post CISA Warns of Active Attacks Exploiting WordPress Core Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has included a WordPress Core vulnerability in its Known Exploited Vulnerabilities catalog due to evidence of active exploitation. This vulnerability, identified as CVE-2026-119977, allows unauthenticated attackers to execute server-side code during a specific software upgrade window. CISA added this vulnerability to the catalog on November 3, 2026, […]
A phishing campaign impersonating OpenAI is using disposable WordPress websites and live attacker oversight to steal payment card details and potentially capture one-time passwords. Fraudulent ChatGPT Plus billing emails warn that subscription payments have failed, directing recipients to counterfeit checkout pages where operators control the victim’s next step. The operation combines infrastructure churn with interactive […]
The post New ChatGPT Phishing Kit Uses Rotating WordPress Websites to
A phishing campaign impersonating OpenAI is using disposable WordPress websites and live attacker oversight to steal payment card details and potentially capture one-time passwords. Fraudulent ChatGPT Plus billing emails warn that subscription payments have failed, directing recipients to counterfeit checkout pages where operators control the victim’s next step. The operation combines infrastructure churn with interactive […]
A critical WordPress Core vulnerability is exploited in the wild. Update to WordPress 7.1.4 immediately to fix the unauthenticated race condition RCE.
Related Posts:
Android SMS of Death Bug Triggers Remote Reboots
JetBrains Patches Critical Flaws in IDEs and Background Services After Certificate Breach
CERT/CC Warns of Xerj Authentication Bypass Flaw CVE-2026-97406
The post WordPress Core Vulnerability Exploited in the Wild appeared first on Daily CyberSecurity.
Details and PoC exploit code are out for critical libheif vulnerabilities GHSA-x8r2-mggj-j6wr and GHSA-2jg2-4ch7-h545. Upgrade to 1.23.3 now.
Related Posts:
Intelbras Camera Vulnerability Lets Attackers Knock Mibo Cameras Offline
Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public
Unauthenticated File Read Leaks Master Key in LiteLLM Enterprise Proxy, CVSS 10.0
The post Public PoC Exploit Disclosed for Critical libheif RCE Vulnerabilities appeared first on Dail
Rank Math has reported a security incident involving malware distributed through Rank Math PRO version 3.0.123. They warn that WordPress websites using this compromised plugin are at risk if administrators activated it. The company has removed the affected files and released a clean version, 3.0.124. Rank Math PRO Compromised The incident impacts a limited number […]
The post Rank Math PRO WordPress Plugin Compromised to Spread Malware and Steal Credentials appeared first on GBHackers Security |
Rank Math has reported a security incident involving malware distributed through Rank Math PRO version 3.0.123. They warn that WordPress websites using this compromised plugin are at risk if administrators activated it. The company has removed the affected files and released a clean version, 3.0.124. Rank Math PRO Compromised The incident impacts a limited number […]
Hackers can compromise vulnerable WordPress websites without stealing passwords by chaining two security flaws in the platform’s core. Disclosed in July 2026, the chain involves CVE-2026-63030 and CVE-2026-60137. Unlike attacks dependent on vulnerable extensions, WP2Shell affects default WordPress installations without requiring a third-party plugin. Public exploit code and observed exploitation have made unpatched deployments an […]
The post Hackers Can Take Over WordPress Websites Without a Pa
Hackers can compromise vulnerable WordPress websites without stealing passwords by chaining two security flaws in the platform’s core. Disclosed in July 2026, the chain involves CVE-2026-63030 and CVE-2026-60137. Unlike attacks dependent on vulnerable extensions, WP2Shell affects default WordPress installations without requiring a third-party plugin. Public exploit code and observed exploitation have made unpatched deployments an […]
Update Rank Math SEO PRO to 3.0.124 now. CVE-2026-111862 is a critical supply-chain compromise actively exploited in the wild via embedded malware.
Related Posts:
Roundcube 1.6.20 and 1.7.5 Fix 20 Security Flaws, Including IMAP Command Injection
PwnEscape Linux Kernel Flaw CVE-2026-99999 Lets VM Guests Escape to the Host
CISA Warns of Critical Flaws in dcm4chee Medical Archive and Unpatched EseeCloud IP Cameras
The post Rank Math SEO PRO Supply-Chain Compromise Exploited in the Wild via Versi
Update the Backuply WordPress plugin to 1.5.9 to fix CVE-2026-93953, a high-severity SQL injection vulnerability impacting 600,000 sites.
Related Posts:
Roundcube 1.6.20 and 1.7.5 Fix 20 Security Flaws, Including IMAP Command Injection
PwnEscape Linux Kernel Flaw CVE-2026-99999 Lets VM Guests Escape to the Host
CISA Warns of Critical Flaws in dcm4chee Medical Archive and Unpatched EseeCloud IP Cameras
The post Backuply WordPress Plugin Patched for High-Severity SQL Injection Vulnerability app
Attackers are actively targeting a critical vulnerability in the Bricksforge WordPress plugin. This flaw allows unauthenticated users to upload malicious files and execute arbitrary PHP code. It is tracked as CVE-2026-85097 and has a CVSS score of 10.0, affecting versions up to 3.1.8.9. Administrators are advised to upgrade to version 3.1.8.10 or later. Patchstack disclosed […]
The post Critical WordPress Bricksforge Flaw Lets Unauthenticated Attackers Execute Remote Code appeared first on GBHac
Attackers are actively targeting a critical vulnerability in the Bricksforge WordPress plugin. This flaw allows unauthenticated users to upload malicious files and execute arbitrary PHP code. It is tracked as CVE-2026-85097 and has a CVSS score of 10.0, affecting versions up to 3.1.8.9. Administrators are advised to upgrade to version 3.1.8.10 or later. Patchstack disclosed […]
An active WordPress XSS campaign exploits Ninja Forms flaw CVE-2026-94504 and CVE-2026-93836 to plant hidden admin accounts. Patch now.
Related Posts:
Apache DolphinScheduler 3.4.3 Fixes Six Authorization Flaws That Leak Passwords and Kubernetes Credentials
wolfSSH 1.6.0 Fixes Five Flaws, Including Critical Host Key Bypass CVE-2026-16516
Cisco Finesse SSRF Flaw CVE-2026-20362 Publicly Disclosed, With Fixes Not Due Until 2027
The post Hackers Exploit Ninja Forms and WPC Product Bundles XSS Fla
The WordPress 7.1.3 security update is a WordPress security release that fixes stored XSS, SQL injection and more. Update your site now.
Related Posts:
CVE-2026-21589 Exploited in the Wild as Atlassian File Read Flaw Details and PoC Go Public
Elastic Patches 14 Flaws in Elasticsearch, Kibana and Elastic Defend
ASUS Patches Four Router Firmware Flaws, Including Two Critical Bugs Rated CVSS 9.3
The post WordPress 7.1.3 Security Update Fixes Stored XSS, SQL Injection and Five More Flaws appeared
WordPress released version 7.1.3 on October 6, 2026, addressing vulnerabilities involving cross-site scripting, SQL injection, information disclosure, and other security weaknesses.
The project recommends immediate updates, with fixes also available for older affected branches. Only the latest WordPress version remains actively supported.
The release documentation lists seven security issues, although its introductory sentence describes “one security fix.” It provides no CVE identifiers, s
The project recommends immediate updates, with fixes also available for older affected branches. Only the latest WordPress version remains actively supported.
The release documentation lists seven security issues, although its introductory sentence describes “one security fix.” It provides no CVE identifiers, severity scores, or confirmed exploitation details. Consequently, the headline’s critical wording should not be interpreted as an official severity classification for every vulnerability.
One vulnerability involves stored cross-site scripting on the Comments administration page. Pending comments provide the attack surface, potentially exposing administrators when they review submitted content.
Thomas Chauchefoin of Trail of Bits reported this issue. The disclosure does not describe the malicious payload or precise conditions required for successful exploitation.
A separate cross-site scripting weakness affects Imgur embeds. WordPress credits Zhengyu Liu, Jingcheng Yang, and Gavin Zhong with reporting it.
These two findings concern different content pathways: comment moderation and embedded media. Both make the update relevant to sites that process user content or display externally sourced material.
WordPress Vulnerabilities
Anthropic reported a second-order SQL injection vulnerability in WordPress WXR export. The release identifies the export component but does not explain the injection sequence, required permissions, or database impact.
Administrators should therefore avoid assuming that the issue enables unrestricted database access or that every export operation is exploitable. Another vulnerability allows unauthenticated disclosure of comments associated with private and unpublished posts.
Reported by Ananda Dhakal of Patchstack, this issue affects information expected to remain outside public access. The announcement identifies comments as the exposed data it does not claim that attackers can retrieve complete private posts.
Anthropic also reported a weakness that lets users with the Author role make posts sticky. This represents an authorization problem involving a publishing capability.
Separately, Alex Concha of the WordPress security team reported forgeable parameters passed to the {status}_{type} hook that can produce action name collisions. The announcement leaves the broader exploitation consequences unspecified.
A denial-of-service issue affects the WP_Http::make_absolute_url() method. Anthropic reported this finding as well, but WordPress provides no request pattern, resource-consumption measurements, or detailed attack prerequisites in the release notes.
Administrators can install WordPress 7.1.3 through Dashboard > Updates or obtain it from the official releases page. WordPress explicitly recommends updating sites immediately because this is a security release. Older affected branches also receive these fixes, but that doesn’t change the project’s stated support policy.
The revised files span administration JavaScript, export handling, REST posts, customization, HTTP processing, embeds, queries, and post operations. No packages were revised.
A WordPress libheif RCE chain and its PoC are now public. The libheif vulnerability turns an HEIC upload into code execution. Patch to 1.23.3.
Related Posts:
CVE-2026-21589 Exploited in the Wild as Atlassian File Read Flaw Details and PoC Go Public
Elastic Patches 14 Flaws in Elasticsearch, Kibana and Elastic Defend
ASUS Patches Four Router Firmware Flaws, Including Two Critical Bugs Rated CVSS 9.3
The post Researchers Publish Full Details and PoC Exploit for a WordPress libheif RCE Chain app
A credential-collection toolkit dubbed TIKTOUK that combines WordPress reconnaissance, exposed-file harvesting, plugin credential decryption, and JavaScript secret scanning. The toolkit consists of two Python scripts, wp2s_poll.py and wp2s_crack.py, alongside a stripped Go-based Linux crawler named jscrawl-amd64. All three components retrieve targets from a central HTTP hub, execute assigned collection tasks, and submit status reports and […]
The post TIKTOUK WordPress Toolkit Could Enable AWS,
A credential-collection toolkit dubbed TIKTOUK that combines WordPress reconnaissance, exposed-file harvesting, plugin credential decryption, and JavaScript secret scanning. The toolkit consists of two Python scripts, wp2s_poll.py and wp2s_crack.py, alongside a stripped Go-based Linux crawler named jscrawl-amd64. All three components retrieve targets from a central HTTP hub, execute assigned collection tasks, and submit status reports and […]
A newly analyzed WordPress malware family, tracked as SC for the “SC_” markers embedded in its injected code, uses a self-healing persistence mesh that can restore a deleted backdoor within seconds. Researchers found that SC does not rely on a single web shell or plugin. Instead, the malware creates at least eight interdependent persistence points, […]
The post SC WordPress Malware Rebuilds Itself After Removal Using Database and Memory Persistence appeared first on GBHackers Security | #1 Globa
A newly analyzed WordPress malware family, tracked as SC for the “SC_” markers embedded in its injected code, uses a self-healing persistence mesh that can restore a deleted backdoor within seconds. Researchers found that SC does not rely on a single web shell or plugin. Instead, the malware creates at least eight interdependent persistence points, […]
Entrar
