WordPress File Permissions: What They Should Be and How to Fix Them
File permissions on a WordPress site are one of those things that work fine until they don’t. Set…
Blog
WordPress User Roles and Permissions: The Complete Security Guide
WordPress user roles control who can do what on your site. A misconfigured role, or worse, an unnecessary…
CVE-2026-1555 – Unauthenticated File Upload in WebStack Theme Gives Attackers Full Server Access
If you run a WordPress site using the WebStack theme, there is no patch available for a critical…
CrawlerX Botnet Uses 500,000 Residential IPs to Brute-Force WordPress Sites
A new botnet called CrawlerX is brute-forcing WordPress admin accounts using half a million residential IP addresses. Unlike…
WordPress 6.8.2 Patches Stored XSS in Block Editor
WordPress released version 6.8.2 on April 21, fixing two stored cross-site scripting (XSS) vulnerabilities in the block editor.…
WordPress Security Checklist 2026: 10 Steps to Harden Your Site
WordPress Security Checklist 2026. Keeping a WordPress site secure in 2026 isn’t about installing a single plugin and…
CVE-2026-4119: Authorization Bypass in Create DB Tables Plugin Exposes WordPress Databases
CVE-2026-4119 Create DB Tables. A critical authorization bypass vulnerability affects the Create DB Tables WordPress plugin. The disclosure…
CVE-2025-4665: Pre-Authentication SQL Injection in CFDB7 Puts 600,000+ WordPress Sites at Risk
A critical SQL injection flaw (CVSS 9.6) in the Contact Form CFDB7 Database Addon plugin allows unauthenticated attackers…
My WordPress Site Was Hacked – Here’s Exactly What to Do
A step-by-step incident response guide for hacked WordPress sites. From locking down access and scanning for malware to…
CVE-2026-0740: Inside the Ninja Forms File Upload Flaw Under Mass Exploitation
On April 6, 2026, Wordfence publicly disclosed a critical unauthenticated arbitrary file upload vulnerability in the Ninja Forms…