SecurityWeek

Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites

Hackers have been exploiting a critical-severity vulnerability in the Elementor Pro WordPress plugin to hack websites, WordPress security firm Defiant warns.
Tech Times on MSN

WordPress backup plugin flaw turns routine backup into full site takeover

All-in-One WP Migration plugin vulnerability CVE-2026-19949 lets attackers plant hidden SQL payloads via WordPress trackbacks; the injected code fires the moment a site admin runs a routine backup, ...
SecurityWeek

Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability

Second-order SQL injection flaw (CVE-2026-19949) in the All-in-One WP Migration and Backup plugin can be exploited for ...
Ars Technica

Critical WordPress plugin vulnerability under active exploit threatens thousands

Thousands of sites running WordPress remain unpatched against a critical security flaw in a widely used plugin that was being actively exploited in attacks that allow for unauthenticated execution of ...
Hosted on MSN

Hackers exploit WordPress plugin security flaw exposing 40,000 websites

Patchstack found critical Modular DS flaw (CVE-2026-23550) allowing admin bypass Vulnerability scored 10/10 and is already being exploited in the wild Vendor released fix in version 2.5.2; users urged ...
Bleeping Computer

Hackers exploit Modular DS WordPress plugin flaw for admin access

Hackers are actively exploiting a maximum severity flaw in the Modular DS WordPress plugin that allows them to bypass authentication remotely and access the vulnerable sites with admin-level ...
Bleeping Computer

Hackers exploit WordPress plugin flaw to infect 3,300 sites with malware

Hackers are breaching WordPress sites by exploiting a vulnerability in outdated versions of the Popup Builder plugin, infecting over 3,300 websites with malicious code. The flaw leveraged in the ...
Hackread

Account Takeover Flaw Hits TranslatePress Plugin Used on 400K WordPress Sites

CVE-2026-19632 exposes WordPress admin password-reset links through TranslatePress, allowing unauthenticated attackers to take over affected WordPress websites.
Searchenginejournal.com

WooCommerce WordPress Plugin Exploit Enables Fraudulent Charges

The WooCommerce Square plugin enables WordPress sites to accept payments through the Square POS, as well as synchronize product inventory data between Square and WooCommerce. Square plugin enables a ...
techtimes

Attackers Exploit WordPress SSO Plugin; Six Paid Editions Were Never in Any Vulnerability Database

Matt Mullenweg, Founder & CEO of Automattic of WordPress, speaks onstage during TechCrunch Disrupt 2024 Day 3 at Moscone Center on October 30, 2024 in San Francisco, California. Kimberly White/Getty ...
Infosecurity-magazine.com

Researchers Build WordPress Exploit Using OpenAI's GPT

Security researchers at Searchlight Cyber have used OpenAI’s GPT5.6 Sol Ultra to successfully develop a full exploit chain for two critical WordPress Core vulnerabilities. The first vulnerability, ...