Bit File Manager CVE-2024-7627: Unauthenticated RCE in a 20,000-Site WordPress Plugin
CVE-2024-7627 is a critical unauthenticated remote code execution flaw in Bit File Manager (versions 6.0-6.5.5), a WordPress plugin…
Category
CVE
Security vulnerability reports and CVE analysis for WordPress plugins, themes, and core.
CVE-2024-11972: Unauthenticated Plugin Installation in Hunk Companion Let Attackers Hijack WordPress Sites (10,000+ Installs, CVSS 9.8)
A critical flaw (CVSS 9.8) in the Hunk Companion plugin let unauthenticated attackers install and activate any plugin…
CVE-2025-1661: Unauthenticated Local File Inclusion in HUSKY Products Filter for WooCommerce (CVSS 9.8)
A critical unauthenticated Local File Inclusion flaw (CVE-2025-1661, CVSS 9.8) in the popular HUSKY - Products Filter Professional…
W3 Total Cache CVE-2024-12365: Subscriber-Level SSRF in 1 Million WordPress Sites
A missing capability check in W3 Total Cache (all versions up to 2.8.1) let any logged-in user —…
CVE-2024-28890: Unauthenticated Arbitrary File Upload in Forminator Exposed 500,000+ WordPress Sites (CVSS 9.8)
CVE-2024-28890 is a critical (CVSS 9.8) unauthenticated arbitrary file upload vulnerability in the Forminator form builder plugin, installed…
CVE-2025-1128: Critical Unauthenticated Arbitrary File Upload in Everest Forms (100,000+ Sites, CVSS 9.8)
A critical flaw in the Everest Forms WordPress plugin (100,000+ installs) let unauthenticated attackers upload, read, and delete…
CVE-2024-11205: WPForms Flaw Let Any Subscriber Refund Your Stripe Payments (6 Million Sites, CVSS 8.5)
CVE-2024-11205 is a missing authorization flaw in WPForms, the form builder active on over 6 million WordPress sites.…
CVE-2025-11833: Unauthenticated Account Takeover in Post SMTP Plugin Actively Exploited (400,000+ Sites, CVSS 9.8)
A critical missing-authorization flaw (CVE-2025-11833, CVSS 9.8) in the Post SMTP plugin lets unauthenticated attackers read logged emails…
WPML CVE-2024-6386: Remote Code Execution via Twig Template Injection on 1 Million Sites
A critical flaw (CVSS 9.9) in the WPML multilingual plugin let authenticated Contributor-level users run arbitrary code through…
CVE-2024-27956: Critical Unauthenticated SQL Injection in WP-Automatic Plugin Exploited in the Wild (CVSS 9.9)
A critical SQL injection flaw in the popular WP-Automatic plugin let unauthenticated attackers run arbitrary database queries, forge…