Category: Security
-
WordPress Credential Stuffing in 2026: Beyond Brute-Force Protection
Credential stuffing now makes up roughly 19% of all authentication attempts — and it uses leaked passwords, not…
-
CVE-2026-19598: Pods Plugin Unauthenticated Admin Takeover
An unauthenticated attacker can escalate to Administrator or overwrite any user’s password, including the site owner’s — full…
-
CVE-2026-76581: WPMU DEV Dashboard Admin Bypass — Update to 5.0.2 Now
An unauthenticated attacker can forge an admin session by replaying an HMAC signature across two mismatched SSO verification…
-
CVE-2026-19708: File Manager Plugin Exposes Full DB Backups
File Manager’s own database backups are downloadable by anyone unauthenticated — a full dump including every password hash.…
-
CVE-2026-87902: WordPress Core RCE — Update to 7.1.2 Immediately
A critical WordPress core flaw, not a plugin bug, was actively probed within 5 hours of its patch…
-
Abandoned WordPress Plugins: The 46% That Will Never Get Patched
46% of newly disclosed WordPress plugin vulnerabilities had no patch available at disclosure — up from 33% the…
-
WordPress Plugin Supply Chain Attacks: Why ‘Stay Updated’ Isn’t Enough
An April 2026 attack compromised 30+ plugins on 400,000+ sites — activated eight months after purchase, delivered through…
-
CVE-2026-27540: WooCommerce Wholesale Lead Capture RCE — Update Now
CVE-2026-27540 (CVSS 9.8) is under active exploitation — Wordfence has already blocked over 100,000 attack attempts against this…
-
CVE-2026-78006: The Events Calendar RCE — Update to 6.17.4.1 Now
CVE-2026-78006 (CVSS 9.8) is under active exploitation and lets an unauthenticated attacker take over 600,000+ sites via a…
Ready to start your project?
Share your brief and we’ll propose the right approach — a full site, a landing page, or a custom plugin.