CVE-2025-13820: Authentication Bypass in Comments Plugin via Disqus Login
A critical authentication bypass CVE-2026-4119 Create DB Tables vulnerability vulnerability has been discovered in the Comments WordPress plugin,…
Category
Security
CVE-2026-1555 – Unauthenticated File Upload in WebStack Theme Gives Attackers Full Server Access
If you run a WordPress site using the WebStack theme, there is no patch available for a critical…
CVE-2025-4665: Pre-Authentication SQL Injection in CFDB7 Puts 600,000+ WordPress Sites at Risk
A critical SQL injection flaw (CVSS 9.6) in the Contact Form CFDB7 Database Addon plugin allows unauthenticated attackers…
My WordPress Site Was Hacked – Here’s Exactly What to Do
A step-by-step incident response guide for hacked WordPress sites. From locking down access and scanning for malware to…
Decryption Failure, Full Takeover: Inside the WPvivid Backup RCE (CVE-2026-1357)
A missing return-value check in WPvivid Backup and Migration turned a failed RSA decryption into an unauthenticated remote…
What Are CAA Records and Why Your WordPress Site Should Have Them
CAA records tell the world which Certificate Authorities are allowed to issue SSL certificates for your domain. Here…
LatePoint Agents, Admin Passwords, and One Missing Check: Inside CVE-2026-1566
A privilege escalation flaw in LatePoint lets users with the Agent role rebind customer records to the site…
CVE-2026-3585: Path Traversal in The Events Calendar Exposes Site Credentials
A path traversal vulnerability in The Events Calendar (CVE-2026-3585) shows how a skipped update and a lingering author…
CVE-2025-13486: The Unauthenticated RCE That Slipped Into 100,000 WordPress Sites
A CVSS 9.8 Remote Code Execution flaw in Advanced Custom Fields: Extended left 100,000 WordPress sites open to…
The Admin Account Nobody Created
A routine WordPress maintenance check turns up two unfamiliar admin accounts - and a 9.8 CVSS vulnerability hiding…