-
A phishing campaign impersonating OpenAI is using disposable WordPress websites and live attacker oversight to steal payment card details and potentially capture one-time passwords. Fraudulent ChatGPT Plus billing emails warn that subscription payments…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
WordPress has released version 7.1.4 to address 22 vulnerabilities, including issues related to remote code execution, stored cross-site scripting, information disclosure, and authorization weaknesses. This security update was published on October 28, …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
TRUST#GRAFT, a JavaScript-to-WordPress attack chain that never breaks WordPress authentication. Instead, it borrows the trust placed in an already logged-in administrator’s browser and uses that session to install a persistent PHP backdoor. Many …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Expect to see quite a few websites serving “404” or “Page Not Found” errors today: Nearly 70 percent of websites need to update their core software to fix a pair of vulnerabilities that allow an attacker to seize full control over affected servers. Experts say there are working exploits for the flaws, and that these critical bugs are already being exploited in the wild.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Attackers exploited compromised UpdraftCentral connection keys to send trusted remote-management commands to WordPress sites, ultimately installing malicious plugins that could provide unauthorized access to these websites. This incident followed unaut…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Rank Math has reported a security incident involving malware distributed through Rank Math PRO version 3.0.123. They warn that WordPress websites using this compromised plugin are at risk if administrators activated it. The company has removed the affe…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Hackers can compromise vulnerable WordPress websites without stealing passwords by chaining two security flaws in the platform’s core. Disclosed in July 2026, the chain involves CVE-2026-63030 and CVE-2026-60137. Unlike attacks dependent on vulnerable …
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Attackers are actively targeting a critical vulnerability in the Bricksforge WordPress plugin. This flaw allows unauthenticated users to upload malicious files and execute arbitrary PHP code. It is tracked as CVE-2026-85097 and has a CVSS score of 10.0…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A credential-collection toolkit dubbed TIKTOUK that combines WordPress reconnaissance, exposed-file harvesting, plugin credential decryption, and JavaScript secret scanning. The toolkit consists of two Python scripts, wp2s_poll.py and wp2s_crack.py, al…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A newly analyzed WordPress malware family, tracked as SC for the “SC_” markers embedded in its injected code, uses a self-healing persistence mesh that can restore a deleted backdoor within seconds. Researchers found that SC does not rely on a single w…
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
