Topic
Vulnerabilities, patches and compromise activity affecting WordPress core, plugins and the sites running them.
Artifex fixed Ghostscript CVE-2026-39919 in 10.08.0 on September 8, closing a heap overflow present in versions 9.21 through 10.07.1. Wordfence, which found the flaw, has seen no exploitation in the wild yet.
Reality
CVE-2026-93485 lets an anonymous WordPress comment run script in a logged-in admin's browser the moment the page loads, with no click required. The sanitizer that cleans the comment on save and the display filters that reformat it read a stray newline differently, and an admin who views it lends the script their plugin-install rights, enough to reach remote code execution.
Reality
Sucuri says a WordPress backdoor it calls SC keeps itself in at least eight places across files, the database and shared memory. Cleaning the plugin or wiping files on disk does not clear it, because any surviving copy rewrites the rest on the next page load.
Reality
Wordfence and Patchstack disclosed five critical bugs in WPMU DEV Dashboard, Avada, TranslatePress, Pods and GiveWP. Only one of them fires with no configuration precondition. That is what sets the patch order.
Reality
Wordfence has blocked nearly 200,000 attempts against CVE-2026-32475 since August 19. Because the payload is a PHP file already sitting in the uploads tree, upgrading to 4.2.2 tells you nothing about whether you were hit.
Perspective Coverage
3 publishersReality
The flaw reaches code execution only where the active theme has a top-level directory starting with page- and a readable local .php file such as pearcmd.php sits on the server. Previdian has logged 68 attempts.
Reality
GreyNoise reports the WordPress intrusion and the Zyxel switch harvest as separate operations run from shared scanning infrastructure by a suspected Chinese-speaking actor it tracks as Kapibala.
Reality
GreyNoise traced scans from a single IP address, running since early June 2026, to a Chinese-speaking actor that breached 49 organizations through WordPress Core and stripped configs and root hashes from 996 ZyXEL switches.
Reality
The WordPress Core bug alone scores 5.3. In a research proof of concept it installs an official catalog theme inside the administrator's browser, the Customizer preview loads that theme's functions.php, and a second bug runs the attacker's PHP.
Reality
Brevo says a long-lived Cloudflare key with full account permissions sat in its application source code, and the Worker built with it stripped Content-Security-Policy headers from scripts that Sansec estimates reach 100,000 sites.
Perspective Coverage
3 publishersReality
pwn.ai rated the forced theme install 7.1 on its own and 9.6 once chained through a theme's unauthenticated handler. The fix shipped on September 17 in a security release reaching branches back to 4.7.
Reality
Melapress surveyed 319 WordPress professionals about the incidents they had handled. Its numbers say the decisions about isolating, restoring and notifying customers are mostly being made in the middle of the outage.
Reality
Janis Elsts pulled the trojanised Admin Menu Editor Pro 2.35 after about seven hours and shipped 2.36 at 19:00 UTC. The intruder still held his server and backdoored that build too. At least 230 customers took the first one.
Reality
CVE-2026-14894 gives an unauthenticated attacker code execution on a WordPress site, and the fix is Super Forms 6.3.314. Microsoft separately reports invisible Unicode tag characters at up to 2.37 million messages a day.
Reality
Patchstack logged 11,334 ecosystem vulnerabilities last year, and 46% had no developer fix when they went public. That turns a care plan built on clicking Update All into a plugin inventory problem.
Reality
The StopAndProtect campaign keeps its payloads, command channel and stolen-file storage on other people's blogs. That makes domain reputation a weaker signal, and cleanup somebody else's bill.
Reality