WordPress released version 7.1.3 on October 6, 2026, addressing vulnerabilities involving cross-site scripting, SQL injection, information disclosure, and other security weaknesses.

The project recommends immediate updates, with fixes also available for older affected branches. Only the latest WordPress version remains actively supported.

The release documentation lists seven security issues, although its introductory sentence describes “one security fix.” It provides no CVE identifiers, severity scores, or confirmed exploitation details. Consequently, the headline’s critical wording should not be interpreted as an official severity classification for every vulnerability.

One vulnerability involves stored cross-site scripting on the Comments administration page. Pending comments provide the attack surface, potentially exposing administrators when they review submitted content.

Thomas Chauchefoin of Trail of Bits reported this issue. The disclosure does not describe the malicious payload or precise conditions required for successful exploitation.

A separate cross-site scripting weakness affects Imgur embeds. WordPress credits Zhengyu Liu, Jingcheng Yang, and Gavin Zhong with reporting it.

These two findings concern different content pathways: comment moderation and embedded media. Both make the update relevant to sites that process user content or display externally sourced material.

WordPress Vulnerabilities

Anthropic reported a second-order SQL injection vulnerability in WordPress WXR export. The release identifies the export component but does not explain the injection sequence, required permissions, or database impact.

Administrators should therefore avoid assuming that the issue enables unrestricted database access or that every export operation is exploitable. Another vulnerability allows unauthenticated disclosure of comments associated with private and unpublished posts.

Reported by Ananda Dhakal of Patchstack, this issue affects information expected to remain outside public access. The announcement identifies comments as the exposed data it does not claim that attackers can retrieve complete private posts.

Anthropic also reported a weakness that lets users with the Author role make posts sticky. This represents an authorization problem involving a publishing capability.

Separately, Alex Concha of the WordPress security team reported forgeable parameters passed to the {status}_{type} hook that can produce action name collisions. The announcement leaves the broader exploitation consequences unspecified.

A denial-of-service issue affects the WP_Http::make_absolute_url() method. Anthropic reported this finding as well, but WordPress provides no request pattern, resource-consumption measurements, or detailed attack prerequisites in the release notes.

Administrators can install WordPress 7.1.3 through Dashboard > Updates or obtain it from the official releases page. WordPress explicitly recommends updating sites immediately because this is a security release. Older affected branches also receive these fixes, but that doesn’t change the project’s stated support policy.

The revised files span administration JavaScript, export handling, REST posts, customization, HTTP processing, embeds, queries, and post operations. No packages were revised.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC

The post Critical WordPress Vulnerabilities Enable XSS, SQL Injection and Data Disclosure Attacks appeared first on Cyber Security News.

Two critical vulnerabilities in The Events Calendar WordPress plugin could allow unauthenticated attackers to take over vulnerable websites.

The flaws affect more than 600,000 active installations. They can lead to remote code execution, administrator password resets, malware deployment, and full server compromise.

Wordfence Argus, developed by the Wordfence Threat Intelligence team, discovered the two independent vulnerability chains on August 21 and August 22, 2026.

Both issues exist in the plugin’s widget-rendering process. They can be exploited without requiring a login, account registration, or user interaction.

The affected plugin is The Events Calendar, developed by StellarWP. Website administrators are strongly advised to update to version 6.17.4.1 or later immediately.

Critical WordPress Plugin Flaws

The first issue, tracked as CVE-2026-78006, has a CVSS score of 9.8. It affects The Events Calendar versions up to 6.17.4. The vulnerability lets attackers abuse PHP object injection to execute operating system commands on the affected web server.

The attack starts when a malicious user submits a specially crafted comment to an event page. The attack only works when comments are enabled for event pages and the plugin’s “Show comments on event pages” setting is active.

However, the attacker doesn’t need an approved comment because WordPress lets comment authors preview their own pending comments through a moderation link.

The Events Calendar processes the full event page, including comments, as Gutenberg blocks. This unsafe design allows malicious block content placed inside a pending comment to reach the plugin’s widget-rendering code.

The vulnerable code validates a widget instance before generating a trusted WordPress hash for it. Researchers found that a malformed serialized PHP payload can bypass the validation. Although the plugin attempts to block dangerous objects, PHP may trigger magic methods while processing the attacker-controlled data.

This behavior can lead to command execution through a vulnerable deserialization routine. An attacker could run commands with the web server user’s permissions, potentially allowing data theft, website defacement, malware installation, or lateral movement within the hosting environment.

The second flaw, CVE-2026-78159, also carries a CVSS score of 9.8. It affects versions up to 6.17.3 and uses a separate path to gain control of the site.

Instead of using object injection, the second attack uses a specially prepared array that passes the plugin’s safety check. The attacker-controlled data is then passed into the widget template system, where it can reach a function that accepts callable PHP functions.

Researchers found that an attacker could abuse this behavior to call WordPress functions with attacker-supplied arguments. One demonstrated impact is resetting the site administrator’s password. The attacker could then sign in as an administrator, upload a malicious plugin, and obtain remote code execution.

StellarWP received the vulnerability reports through the Wordfence Vulnerability Management Portal. The vendor acknowledged both reports on August 24, 2026, and released patches shortly afterward. The fully patched release is version 6.17.4.1.

Wordfence Premium, Care, and Response customers received firewall protection for known exploit attempts on August 22, 2026. Free Wordfence users are scheduled to receive the same rule on September 21, 2026.

Site owners should update The Events Calendar immediately, review whether comments are enabled on event pages, remove unneeded plugins, and inspect administrator accounts and server logs for suspicious activity.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post Critical WordPress Plugin Flaws Put Over 600,000 Websites at Risk of Takeover appeared first on Cyber Security News.