BdThemes supply chain attack poisons JSON feed to create rogue WordPress admins and deploy web shells without code changes.

A threat actor compromised the upstream infrastructure of BdThemes, a developer of premium WordPress web-design tools, and modified a remote JSON feed delivered to administrators' browsers to create ...

Wordfence was notified of the compromise on August 7 and published its analysis the following day. It affects BdThemes, an Elementor add-on vendor whose plugins are distributed through the official ...

WordPress fixes CVE-2026-64638, a pre-auth login XSS affecting every version, with a demonstrated path to PHP execution under ...

Pakistan’s National Cyber Emergency Response Team (National CERT) has issued a high-severity cybersecurity advisory, warning that actively exploited vulnerabilities in WordPress Core could allow ...

Pakistan’s National CERT has warned of critical WordPress flaws that could let hackers take control of websites and urged organizations to patch them immediately.

| CVSS 9.8 (out of 10) | Active exploitation confirmed | Patch to 6.9.5 / 7.0.2 immediately TL;DR Two chained WordPress Core vulnerabilities (CVE-2026-63030 and CVE-2026-60137) give an unauthenticated ...

Cloud hosting offers the resource flexibility and power that you won't find with standard, single-server web hosting. Here's everything you need to know to choose the right cloud hosting service for ...

WordPress 6.9.5 and 7.0.2 fix wp2shell, a core REST API bug chaining route confusion and SQL injection into unauthenticated remote code execution.

Attackers are exploiting two recently patched vulnerabilities affecting WordPress core software. Image: Deng Xiang/Unsplash Security researchers warn hackers are actively exploiting two patched ...