Your website, patched before attackers get there.

WordPress 7.1.4 fixes 22 issues, including RCE during core updates

The release fixes a race condition in the full-package update process that an unauthenticated attacker can turn into code execution, plus many stored XSS bugs. Wordfence saw more than 18,500 requests aimed at the staged installer path within 21 hours, and fixes are backported through branch 4.7.

Affected: WordPress 4.7.0 through 7.1.3 (fixed in 7.1.4 and backports such as 6.9.11, 7.0.8)

Sources: WordPress.org, Wordfence

Node.js Brotli flaw (Node2Shell) added to CISA exploited list

An out-of-bounds write in the Brotli decoder used by node:zlib can crash a process, leak memory or in the worst case run code, and CISA listed it as exploited on 27 October. Akamai's analysis says 61 percent of networks it sees run an affected Node.js version and that upgrading is the only full fix.

Affected: Node.js 22 before 22.23.4, 24 before 24.22.1, 26 before 26.12.1; end-of-life lines unpatched

• CVE-2026-111497

Sources: Akamai, CISA KEV catalog feed, Node.js

Magento PolyShell file upload flaw added to CISA exploited list

CISA listed an unrestricted file upload flaw in Adobe Commerce and Magento that can give code execution. Store owners should confirm they run the vendor patch and check for planted files.

Affected: Adobe Commerce and Magento (see Adobe bulletin)

• CVE-2026-48356

Sources: CISA KEV catalog feed

PHP Windows builds rebuilt with a Brotli fix reachable through cURL

PHP published rebuilt Windows packages that include Brotli 1.2.1 to close an out-of-bounds write in Brotli decompression. The decoder can be reached through the cURL extension when automatic response decompression is turned on, which is off by default.

Affected: PHP for Windows 8.2.35, 8.3.36, 8.4.27, 8.5.12 builds before the -1 rebuild

• CVE-2026-111497

Sources: php.net news, CISA KEV catalog feed

Reported PHP2Shell intrusion took over 24 firewalls in a government environment

Dream reported that an attacker adapted the PHP2Shell exploit to an unnamed firewall product and chained a Linux kernel flaw to control 24 internet-facing firewalls and a management server. Wordfence notes the vendor is not named and it has not verified the claim, and it does not involve WordPress.

Affected: Internet-facing firewalls running PHP management interfaces

• CVE-2026-109618

Sources: Wordfence

PHP flags a third, unlikely RCE path via session upload progress

PHP disclosed another remote code execution issue that only works when an application switches the session serialize handler at runtime while session upload progress is still enabled. The project will publish the full advisory for CVE-2026-115560 with the next regular release and advises setting session.upload_progress.enabled=0 until then.

Affected: PHP installations with unusual session configuration (php_binary or php_serialize switched to php via ini_set before session_start)

• CVE-2026-115560

Sources: php.net news, CERT-EU, Wordfence

PHP2Shell: two critical PHP flaws allow unauthenticated code execution

PHP shipped emergency releases for two flaws that let a single unauthenticated web request run code, one through memory corruption when PHP runs out of memory and one through request state that outlives its memory. Details leaked a day early, attacks were seen from 21 October and CISA added both flaws to its exploited list on 26 October.

Affected: PHP 8.2 before 8.2.35, 8.3 before 8.3.36, 8.4 before 8.4.27, 8.5 before 8.5.12; PHP 8.1 and older have no official fix; all web SAPIs including mod_php, PHP-FPM, php-cgi, FrankenPHP, LiteSpeed

• CVE-2026-109618
• CVE-2026-109619

Sources: CISA alert, watchTowr, CERT-EU, Huntress, php.net news, CISA KEV catalog feed

Node.js and WordPress update root certificates after eMudhra CA compromise

Node.js refreshed its bundled certificate store after the eMudhra intermediate CA was compromised, and WordPress 7.1.4 updated its root certificates after the revocation. Sites that run their own certificate stores should do the same.

Affected: Bundled CA stores in Node.js 22, 24, 26 and WordPress

Sources: Node.js, WordPress.org

Node.js October security release fixes 10 CVEs, four rated high

The release fixed four high issues, a Brotli out-of-bounds write and three TLS or DNS name handling bugs that let a certificate for one name authenticate another host, plus six medium and low issues. Fixed versions are 22.23.4, 24.22.1 and 26.12.1, with updated c-ares, OpenSSL, SQLite and undici.

Affected: Node.js 22, 24 and 26 lines before 22.23.4, 24.22.1, 26.12.1

• CVE-2026-111497
• CVE-2026-105482
• CVE-2026-105483
• CVE-2026-106069

Sources: Node.js

Duplicator: high severity flaw (CVE-2026-82814)

Duplicator had an unauthenticated PHP object injection flaw. Wordfence Argus found it and urges Free and Pro users to update to version 5.0.0 or newer.

Affected: Duplicator Free up to 1.5.17 and matching Duplicator Pro releases, fixed in 5.0.0

• CVE-2026-82814

Sources: Wordfence

AI agents on the Cairn platform breached more than 100 organisations

NorForge found exposed control panels of the open-source Cairn agent platform and traced a campaign where a Chinese speaking operator pointed agents at e-commerce sites in the US, Japan and Australia with over 1,100 attack projects. Reuters reported more than 100 company sites breached, with a success rate near 10 percent.

Affected: E-commerce and payment sites in the US, Canada, Australia and Japan

Sources: SecurityWeek

UpdraftCentral connection keys stolen, used to install malicious plugins

TeamUpdraft said its website database was accessed on 17 and 18 October, including connection keys for UpdraftCentral. Attackers then used valid signed commands to upload, activate and delete malicious plugins on connected WordPress sites, so sites linked to the cloud dashboard are at most risk.

Affected: UpdraftPlus Free and Premium on sites connected to cloud-hosted UpdraftCentral

• CVE-2026-10795

Sources: Wordfence

Rank Math SEO PRO 3.0.123 downloads contained malware

Some copies of Rank Math SEO PRO 3.0.123 downloaded or updated between 15 October 20:02 UTC and 16 October 07:12 UTC contained malware. Rank Math released a clean 3.0.124, and Wordfence says affected sites should be treated as compromised because updating alone does not remove extra files, admin accounts or scheduled tasks.

Affected: Rank Math SEO PRO (seo-by-rank-math-pro) 3.0.123, fixed in 3.0.124

• CVE-2026-111862

Sources: Wordfence

Backuply: high severity flaw (CVE-2026-93953)

Backuply (600,000 active installs) had a second-order SQL injection that gives subscribers a route to privilege escalation. Versions up to 1.5.8 are affected and 1.5.9 fixed it on 1 October 2026.

Affected: Backuply up to 1.5.8, fixed in 1.5.9

• CVE-2026-93953

Sources: Wordfence

nginx 1.30.6 and 1.31.7 fix five vulnerabilities including alias buffer overflow

The October releases fix a buffer overflow with alias and rewrite, a buffer overflow in script evaluation, HTTP/3 request body injection, TLS session ticket forgery and a use-after-free with AIO. nginx.org rates all five medium, and the njs scripting engine got a separate fix the same day.

Affected: nginx up to 1.30.5 and 1.31.0 to 1.31.6 (varies per CVE)

• CVE-2026-15176
• CVE-2026-93479
• CVE-2026-95101
• CVE-2026-97629

Sources: nginx.org, nginx.org changes

Next.js out-of-band release fixes two critical RCEs and a Server Actions DoS

Vercel shipped 15.5.28 and 16.4.1 to fix an unauthenticated remote code execution in the use-cache feature, another in SVG processing through sharp and librsvg, and a high severity denial of service in Server Actions. No in-the-wild exploitation was reported as of 15 October and Next.js 14 and older have no patched release.

Affected: Next.js 16.0.0 - 16.4.0 (use cache RCE), 10.0.0 - 15.5.27 and 16.0.0 - 16.4.0 (SVG RCE), 13.0.0 - 15.5.27 and 16.0.0 - 16.4.0 (DoS)

• CVE-2026-96889

Sources: Cloud Security Alliance

Drupal core Field UI remote code execution (SA-CORE-2026-014)

A remote code execution flaw in the Field UI module cannot be exploited by core alone, but contributed modules create paths and at least one needs no authentication. Fixed in Drupal 10.6.19, 11.3.19 and 11.4.10, and uninstalling Field UI is a mitigation.

Affected: Drupal 8.9 to 10.6.18, 11.0 to 11.3.18, 11.4.0 to 11.4.9, 12.0.0 alpha1 to beta2

• CVE-2026-108097

Sources: Drupal.org

Magento BlockStrap: new CVSS 10 RCE bypasses the StyleSmuggler hotfix

A template engine injection in Magento's email templates lets unauthenticated attackers run PHP on the store server, and it bypasses the September hotfix. Sansec reproduced four exploit routes within a day but saw no attacks on live stores yet.

Affected: Magento Open Source and Adobe Commerce up to 2.4.9, B2B up to 1.5.3, Mage-OS up to 3.5.0

• CVE-2026-103849

Sources: Sansec

Ghostscript heap overflow reachable through PDF thumbnails on servers

Wordfence Argus found a critical heap buffer overflow in Ghostscript, the tool many sites use to render uploaded PDFs as thumbnails. Fixed in Ghostscript 10.08.0 released on 8 September 2026.

Affected: Ghostscript before 10.08.0

• CVE-2026-39919

Sources: Wordfence

WordPress 7.1.3 fixes 7 security issues including second-order SQL injection

The release fixed stored XSS on the comments admin page, a denial of service in URL handling, a second-order SQL injection in the WXR export and the disclosure of comments on private posts. Several reports are credited to AI-lab and security-firm teams such as Anthropic and Trail of Bits with OpenAI.

Affected: WordPress before 7.1.3 (backports to older branches)

Sources: WordPress.org

OpenSSL fixes a high severity DTLS heap leak among 14 issues

A flaw in DTLS retransmission can send bytes from the wrong buffer position, leaking heap data or crashing the program. Fixed versions include 4.0.3, 3.6.5, 3.5.9 and 3.4.8, with 3.0.23, 1.1.1zj and 1.0.2zs for older lines.

Affected: OpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1, 1.0.2 before the listed fixes

• CVE-2026-84782

Sources: OpenSSL

Joomla 5.4.9 and 6.1.4 fix 16 issues including SSRF and directory deletion

Two issues are rated high, a server-side request forgery in core extensions and arbitrary directory deletion through the cache purge action, and an MFA bypass through early remember-me cookies was also fixed. Note that 5.4.9 breaks some API PATCH requests.

Affected: Joomla 4.0.0 to 5.4.8 and 6.0.0 to 6.1.3

• CVE-2026-92222
• CVE-2026-90915
• CVE-2026-92227

Sources: Joomla Security Centre, Droptimes

PHP 8.5.11 fixes 11 security issues including FPM ACL bypass and TLS checks

The 8.5.11 release closed eleven issues, among them an IPv6 access-list bypass in PHP-FPM, TLS hostname verification falling back to the certificate common name, a heap overflow in wildcard certificate matching and a credential leak when HTTP redirects cross origins. Other flaws touched SOAP, Phar and mysqlnd.

Affected: PHP 8.5 before 8.5.11 (changelog lists the 8.5 branch)

• CVE-2026-91768
• CVE-2026-91769
• CVE-2026-91767
• CVE-2025-1218

Sources: PHP ChangeLog

Magento incorrect authorization flaw added to CISA exploited list

CISA listed an incorrect authorization flaw in Adobe Commerce and Magento that lets an attacker reach sensitive resources without user interaction. It was added two weeks after the StyleSmuggler zero-day, showing sustained attacker interest in the platform.

Affected: Adobe Commerce and Magento (see Adobe bulletin)

• CVE-2026-71362

Sources: CISA KEV catalog feed

Attacker used three open-source AI harnesses to breach retailers and steal 600,000 cards

Gambit Security documented an operator who combined Strix for discovery, Cairn for exploitation and Hermes for orchestration across 105 attack projects, compromising at least 27 companies at about 25 dollars per target. More than 600,000 card records were taken from two companies and skimmers were found on 19 sites with 100 more linked.

Affected: Online retailers including Magento shops; SQL injection, web shell and cloud key theft chain

Sources: Hackread

WordPress 7.1.2 fixes critical unauthenticated local file inclusion

A flaw in template resolution let an unauthenticated visitor make WordPress include a readable local PHP file from outside the theme folders, which can lead to code execution on some server and theme setups. CISA listed it as exploited on 25 September, and fixes exist for every branch back to 4.7.

Affected: WordPress 4.7 through 7.1.1 (fixed in 7.1.2 and backports such as 6.9.9, 7.0.6)

• CVE-2026-87902

Sources: WordPress.org, Wordfence, CISA KEV catalog feed

libheif heap overflow can lead to file read and code execution on image servers

Wordfence Argus found a critical heap buffer overflow in libheif, the library servers use to open iPhone HEIC photos, and showed it can lead to arbitrary file read and code execution. Versions 1.18.0 to 1.23.2 are affected and 1.23.3 fixes it.

Affected: libheif 1.18.0 to 1.23.2

Sources: Wordfence

WordPress 7.1.1 fixes 11 security issues from XSS to path traversal

Eleven fixes landed, among them stored XSS in wpautop, unauthorised theme installation through crafted URLs, a path traversal in the REST templates controller and contributors being able to overwrite arbitrary posts. Two of the reports are credited to Anthropic.

Affected: WordPress before 7.1.1 (backports to older branches)

Sources: WordPress.org

Tutor LMS: high severity flaw (CVE-2026-78175)

Tutor LMS (100,000 active installs) had a PHP object injection that leads to remote code execution for subscriber accounts. Version 4.0.8 fixed it on 10 September 2026 after Wordfence Argus reported the flaw.

Affected: Tutor LMS up to 4.0.7, fixed in 4.0.8

• CVE-2026-78175

Sources: Wordfence

nginx 1.30.5 fixes a heap overflow in the HTTP/3 module

A buffer overflow in ngx_http_v3_module was fixed in stable 1.30.5 and mainline 1.31.6. Only servers that enable HTTP/3 over QUIC are exposed.

Affected: nginx 1.29.2 to 1.30.4 and 1.31.0 to 1.31.5

• CVE-2026-90439

Sources: nginx.org, nginx.org changes

WooCommerce Wholesale Lead Capture: critical flaw under active attack (CVE-2026-27540)

WooCommerce Wholesale Lead Capture (6,000 active installs) had an unauthenticated arbitrary file upload that attackers are actively exploiting. It was disclosed in February 2026, version 2.0.3.2 fixes it and Wordfence has blocked more than 100,000 attempts.

Affected: WooCommerce Wholesale Lead Capture up to 2.0.3.1, fixed in 2.0.3.2

• CVE-2026-27540

Sources: Wordfence

The Events Calendar: critical flaw (CVE-2026-78006)

The Events Calendar had two unauthenticated chains leading to remote code execution. Wordfence Argus found them and fixes shipped on 10 September 2026 as 6.17.4.1 and 6.17.3.1.

Affected: The Events Calendar up to 6.17.4 (fixed in 6.17.4.1) and up to 6.17.3 (fixed in 6.17.3.1)

• CVE-2026-78006
• CVE-2026-78159

Sources: Wordfence

Magento StyleSmuggler zero-day: CVSS 10 RCE exploited since 4 September

An unauthenticated template injection through style properties gives code execution on Magento Open Source and Adobe Commerce 2.4.4 to 2.4.9, and attacks started on 4 September before Adobe's hotfix on 7 September. The hotfix does not clean stores that were already compromised, so merchants must scan and rotate keys.

Affected: Magento Open Source and Adobe Commerce 2.4.4 to 2.4.9; no fix for 2.4.3 and older

• CVE-2026-75650

Sources: Sansec, CISA KEV catalog feed

Customer data of a hardware wallet maker exposed through its logistics provider, 81,000 people

A logistics provider was breached, reportedly through the Metabase flaw, exposing about 14,000 customers first and then another 67,000 US customers whose old data had not been deleted. The company says its own systems and devices were not compromised.

Affected: Customer names, emails, phones and shipping addresses at a third-party vendor

• CVE-2026-72898

Sources: BleepingComputer

Super Forms: critical flaw under active attack (CVE-2026-14894)

Super Forms (13,000 active installs) had an unauthenticated arbitrary file upload that leads to code execution and is under active attack. Version 6.3.314 fixed it in July 2026 and Wordfence has blocked more than 250,000 exploit attempts.

Affected: Super Forms up to 6.3.313, fixed in 6.3.314

• CVE-2026-14894

Sources: Wordfence

Gravity Forms: high severity flaw (CVE-2026-19513)

Gravity Forms had an unauthenticated arbitrary file upload through chunk hash confusion. Wordfence Argus discovered it and version 3.0.3 contains the fix.

Affected: Gravity Forms up to 3.0.2, fixed in 3.0.3

• CVE-2026-19513

Sources: Wordfence

All-in-One WP Migration and Backup: high severity flaw (CVE-2026-19949)

All-in-One WP Migration and Backup (5,000,000 active installs) had an unauthenticated second-order SQL injection through archive restore that can lead to code execution. Version 7.110 fixed it on 20 August 2026, three days after the developer acknowledged the report.

Affected: All-in-One WP Migration and Backup up to 7.109, fixed in 7.110

• CVE-2026-19949

Sources: Wordfence

WPMU DEV Dashboard: critical flaw (CVE-2026-76581)

WPMU DEV Dashboard (350,000 active installs) had a critical authentication bypass in its Hub single sign-on. Version 5.0.2 fixes it and sites that cannot update should disable Hub SSO meanwhile.

Affected: WPMU DEV Dashboard up to 5.0.1, fixed in 5.0.2

• CVE-2026-76581

Sources: Wordfence

TranslatePress: critical flaw (CVE-2026-19632)

TranslatePress (400,000 active installs) had an unauthenticated account takeover through password reset link disclosure. Version 3.3.2 was released on the same day the developer acknowledged the report, 13 August 2026.

Affected: TranslatePress Multilingual up to 3.3.1, fixed in 3.3.2

• CVE-2026-19632

Sources: Wordfence

Avada theme and Fusion Builder: critical flaw (CVE-2026-18431)

Avada theme and Fusion Builder (1,000,000 sales active installs) had a six-step unauthenticated chain to remote code execution via arbitrary file write. The AI vulnerability agent Wordfence Argus found it in the Avada theme up to 7.16 and Fusion Builder up to 3.16.

Affected: Avada theme up to 7.16 and Fusion Builder (fusion-builder) up to 3.16

• CVE-2026-18431

Sources: Wordfence

AI agent Wordfence Argus found a six-step RCE in the Avada theme

Wordfence's internal AI vulnerability agent Argus found an unauthenticated six-step chain to code execution in the Avada theme, sold over a million times. Wordfence calls Argus faster than a human team and has since published more of its finds.

Affected: Avada theme up to 7.16, Fusion Builder up to 3.16

• CVE-2026-18431

Sources: Wordfence, Wordfence

Pods: critical flaw (CVE-2026-19598)

Pods (100,000 active installs) had an unauthenticated privilege escalation. Patched releases such as 3.3.9.1 and 3.2.8.3 came out on 14 August 2026 and the WordPress.org plugins team pushed a forced update.

Affected: Pods before 3.3.9.1, with backported fixes 3.2.8.3, 3.1.4.2, 3.0.10.4, 2.9.19.4, 2.8.23.4

• CVE-2026-19598

Sources: Wordfence

Elementor Pro: critical flaw under active attack (CVE-2026-32475)

Elementor Pro (6,000,000 active installs) had an unauthenticated arbitrary file upload through a validation bypass. Version 4.2.2 shipped on 19 August 2026 and attackers started using the flaw the same day, with more than 190,000 attempts blocked by Wordfence.

Affected: Elementor Pro up to 4.2.1, fixed in 4.2.2

• CVE-2026-32475

Sources: Wordfence, Wordfence

Joomla 5.4.8 and 6.1.3 fix 9 issues including an MFA authentication bypass

The August batch fixed a multi-factor authentication bypass, inconsistent access checks on web service endpoints and unrestricted upload of SHTML files. Most were rated moderate or low.

Affected: Joomla up to 5.4.7 and 6.1.2

• CVE-2026-73337
• CVE-2026-71574
• CVE-2026-73373

Sources: Joomla Security Centre

Forminator Forms: critical flaw (CVE-2026-15748)

Forminator Forms (600,000 active installs) had an unauthenticated arbitrary file upload via a forged upload field configuration. Version 1.56.2 fixed it on 31 July 2026.

Affected: Forminator Forms up to 1.56.1, fixed in 1.56.2

• CVE-2026-15748

Sources: Wordfence

User Profile Builder: critical flaw (CVE-2026-15826)

User Profile Builder (40,000 active installs) had an unauthenticated authentication bypass that allows administrator takeover. Version 3.16.5 fixed it on the day the report was acknowledged, 16 July 2026.

Affected: User Profile Builder up to 3.16.4, fixed in 3.16.5

• CVE-2026-15826

Sources: Wordfence

WordPress 7.0.4 fixes RCE through file upload with Imagick and Ghostscript

An authenticated user with Author rights could reach remote code execution by uploading a crafted file on sites that use Imagick together with Ghostscript. The fix is backported to the 4.7 branch.

Affected: WordPress sites using Imagick and Ghostscript, before 7.0.4 (and backports)

• CVE-2026-65640

Sources: WordPress.org

BdThemes plugins hit through a poisoned remote promo banner feed

Attackers changed a remote JSON feed used by an admin promotional banner, so no code in the WordPress.org repository was modified yet several plugins from the vendor were compromised. The affected plugins were temporarily closed while the plugin review team investigated.

Affected: Several BdThemes plugins in the WordPress.org directory

• CVE-2026-92991

Sources: Wordfence

WordPress 7.0.3 fixes 12 issues including a pre-auth login page XSS

The release fixed a reflected XSS on the login screen that could lead to PHP code execution, several contributor-level stored XSS bugs, a multisite privilege escalation and an SSRF in URL validation. Backports cover all branches eligible for security fixes.

Affected: WordPress before 7.0.3 (backports to older branches)

• CVE-2026-64638

Sources: WordPress.org

Metabase zero-day SQL injection breached five companies

Attackers used an unauthenticated SQL injection in Metabase's password reset endpoint to become administrator and read connected database credentials. Five companies were reported as breached, CISA listed it on 11 August, and Metabase Cloud had already been patched.

Affected: Self-hosted Metabase 0.58 to 0.63.4 and matching Enterprise builds

• CVE-2026-72898

Sources: Tech Times

ChainDrop worm hits 400+ npm packages including keyv and flat-cache

A Shai-Hulud variant started from a compromised maintainer and republished infected versions of caching libraries such as keyv, flat-cache and cache-manager, stealing npm, GitHub and cloud credentials. Microsoft counts over 400 packages and Singapore's CSA over 1,300 package versions with about 2 billion monthly downloads.

Affected: keyv 6.0.0, flat-cache 6.1.24, cache-manager 7.2.10 and other listed versions

Sources: Microsoft Security Blog, CSA Singapore

PHP 8.5.9 fixes bccomp write overflow and PostgreSQL SQL injection

The release fixed an out-of-bounds write in the BCMath bccomp function and an SQL injection caused by a backslash breakout in PostgreSQL escaped string literals. It also upgraded the bundled libgd and fixed a crash with recursive symlinks in Phar.

Affected: PHP 8.5 before 8.5.9 (changelog lists the 8.5 branch)

• CVE-2026-17544
• CVE-2026-17543
• CVE-2026-9672
• CVE-2026-7260

Sources: PHP ChangeLog

Node.js July security release fixes 11 CVEs, three rated high

The delayed July release fixed HTTP/2 memory exhaustion, an HTTP/2 use-after-free and a Permission Model flaw that over-granted file access, all rated high. Fixed versions are 22.23.2, 24.18.1 and 26.5.1, and undici and llhttp were updated.

Affected: Node.js 22, 24 and 26 lines before 22.23.2, 24.18.1, 26.5.1

• CVE-2026-56846
• CVE-2026-56848
• CVE-2026-58043
• CVE-2026-56850

Sources: Node.js

Backdoor planted in Advanced Responsive Video Embedder, caught in two hours

Malicious code added to the plugin gave any unauthenticated visitor full administrator access with one request and a hardcoded token. Wordfence's AI agent PRISM flagged it less than two hours after it appeared, and the plugin was closed for download.

Affected: Advanced Responsive Video Embedder (advanced-responsive-video-embedder) 10.8.7 and 10.8.8, about 20,000 installs; clean release 10.9.0

• CVE-2026-18072

Sources: Wordfence

Wordfence's autonomous AI researcher became its top vulnerability finder

Wordfence says its AI agent PRISM published 88 vulnerabilities in 30 days, about 2.8 a day, and became its number one researcher with 202 found overall. It shows defenders can use agents at scale, and attackers can do the same.

Affected: WordPress plugins and themes

Sources: Wordfence

wp2shell: WordPress core RCE chain patched, exploited within days

Two flaws, a REST API batch route confusion and a SQL injection, chain into unauthenticated code execution on a default WordPress install, the first such core chain in nearly a decade. WordPress forced updates, CISA listed both as exploited on 21 July and Wordfence blocked more than 11 million attempts.

Affected: WordPress 6.9.x before 6.9.5, 7.0.x before 7.0.2; 6.8.x before 6.8.6 for the SQL injection only

• CVE-2026-63030
• CVE-2026-60137

Sources: WordPress.org, Wordfence, Wordfence, CISA KEV catalog feed

nginx 1.30.4 fixes a major heap overflow in map with regex

nginx.org rates the heap overflow when using map with regular expressions as major, and it affects versions back to 0.9.6. The same release fixed memory disclosure in the slice module and a use-after-free in the SSI module.

Affected: nginx 0.9.6 to 1.31.2

• CVE-2026-42533
• CVE-2026-60005
• CVE-2026-56434

Sources: nginx.org, nginx.org changes

AsyncAPI npm packages poisoned with an import-time loader

Five malicious versions of four @asyncapi packages were published within about 90 minutes through the project's own trusted publishing, so they carried valid provenance. The loader ran on import rather than install, which means the usual ignore-scripts protection did not stop it.

Affected: @asyncapi/specs 6.11.2 and 6.11.2-alpha.1, @asyncapi/generator 3.3.1, generator-components 0.7.1, generator-helpers 1.1.1

Sources: Microsoft Security Blog, Unit 42

PHP 8.5.8 fixes memory corruption in openssl_encrypt with AES wrap

A heap corruption bug was fixed in openssl_encrypt when the AES-WRAP-PAD cipher is used. Applications that pass untrusted cipher names or data to that function were the ones at risk.

Affected: PHP 8.5 before 8.5.8 (changelog lists the 8.5 branch)

• CVE-2026-14355

Sources: PHP ChangeLog

Avada Builder (Fusion Builder): critical flaw (CVE-2026-8713)

Avada Builder (Fusion Builder) (1,000,000 active installs) had an unauthenticated arbitrary file deletion flaw. Versions up to 3.15.3 are affected and 3.15.4 fixes it.

Affected: Avada (Fusion) Builder up to 3.15.3, fixed in 3.15.4

• CVE-2026-8713

Sources: Wordfence

Node.js June security release fixes 12 CVEs, two rated high

Two high issues were fixed: a WebCrypto integer overflow that crashes the process and a TLS wildcard check that could be bypassed with Unicode dot separators. Ten medium and low fixes covered HTTP/2, proxy credentials in error messages and Permission Model bypasses, shipped in 22.23.0, 24.17.0 and 26.3.1.

Affected: Node.js 22, 24 and 26 lines before 22.23.0, 24.17.0, 26.3.1

• CVE-2026-48933
• CVE-2026-48618
• CVE-2026-48615
• CVE-2026-48617

Sources: Node.js

Gravity SMTP: medium severity flaw under active attack (CVE-2026-4020)

Gravity SMTP (100,000 active installs) had an unauthenticated sensitive information exposure through its REST API. API keys and OAuth tokens could be read, version 2.1.5 fixes it and Wordfence has blocked more than 17 million exploit attempts.

Affected: Gravity SMTP up to 2.1.4, fixed in 2.1.5

• CVE-2026-4020

Sources: Wordfence

ShapedPlugin build pipeline compromised, Pro plugins shipped with a backdoor

Attackers broke into the vendor's build and distribution pipeline and injected backdoor code into Pro plugin releases delivered through the official licensed update channel. Customers who followed best practice and updated normally were still exposed.

Affected: ShapedPlugin Pro plugins (vendor has over 400,000 free installs)

• CVE-2026-10735
• CVE-2026-49777

Sources: Wordfence

UpdraftPlus: critical flaw (CVE-2026-10795)

UpdraftPlus (3,000,000 active installs) had a critical unauthenticated authentication bypass that is exploitable on sites connected to UpdraftCentral. Attackers could run remote procedure calls as the connected administrator, for example to upload a malicious plugin.

Affected: UpdraftPlus Free and Premium on sites connected to UpdraftCentral, before the June 2026 patched release

• CVE-2026-10795

Sources: Wordfence

OpenSSL June release: PKCS#7 use-after-free found with help of Claude

A high severity heap use-after-free in PKCS#7 signature verification was found by a researcher working with Claude and Anthropic Research. SecurityWeek counts 18 flaws in that release and credits Anthropic's Alex Gaynor with about half a dozen of them.

Affected: OpenSSL builds before the June 2026 releases (3.x branches, see advisory)

• CVE-2026-45447

Sources: SecurityWeek, OpenSSL

Apache httpd 2.4.68 fixes 13 CVEs, six moderate

The release fixed a buffer overflow in mod_proxy_html, an escalation through .htaccess expressions and a denial of service in mod_http2, among others. All 13 are rated moderate or low.

Affected: Apache HTTP Server 2.4.0 through 2.4.67

• CVE-2026-34355
• CVE-2026-42535
• CVE-2026-43951
• CVE-2026-44119

Sources: Apache HTTP Server project

PHP 8.5.7 updates the bundled uriparser after two URI flaws

The release updated uriparser to 1.0.2 to fix a pointer truncation problem and a bug where two different URIs could be treated as equal. Both matter for code that validates or compares URLs.

Affected: PHP 8.5 before 8.5.7 (bundled uriparser before 1.0.2)

• CVE-2026-44927
• CVE-2026-44928

Sources: PHP ChangeLog

Everest Forms Pro: critical flaw under active attack (CVE-2026-3300)

Everest Forms Pro (4,000 active installs) had a critical remote code execution flaw that attackers are exploiting. Version 1.9.13 fixes it, versions up to 1.9.12 are affected and Wordfence has blocked more than 29,300 attempts.

Affected: Everest Forms Pro up to 1.9.12, fixed in 1.9.13

• CVE-2026-3300

Sources: Wordfence

Kirki: critical flaw (CVE-2026-8206)

Kirki (500,000 active installs) had an unauthenticated privilege escalation. Versions 6.0.0 to 6.0.6 are affected and 6.0.7 contains the fix.

Affected: Kirki 6.0.0 - 6.0.6, fixed in 6.0.7

• CVE-2026-8206

Sources: Wordfence

32 @redhat-cloud-services npm packages compromised via an employee GitHub account

A compromised Red Hat employee GitHub account pushed commits that bypassed review and published at least 32 packages with valid provenance. The packages are small by download count, about 80,000 weekly on average.

Affected: At least 32 @redhat-cloud-services npm packages

Sources: Unit 42

WP Maps Pro: critical flaw (CVE-2026-8732)

WP Maps Pro (15,000 active installs) had flaws that let unauthenticated visitors create administrator accounts. Version 6.1.1 fixes the issue in releases up to 6.1.0.

Affected: WP Maps Pro up to 6.1.0, fixed in 6.1.1

• CVE-2026-8732
• CVE-2026-8935

Sources: Wordfence

Claude Mythos found over 10,000 high or critical flaws in widely used software

Anthropic's Project Glasswing update says Mythos and partners found more than 10,000 high or critical issues, and a scan of over 1,000 open-source projects yielded 23,019 findings. Cloudflare and Mozilla each found hundreds of flaws in their own code, and maintainers now struggle to fix them as fast as they are found.

Affected: Open-source and commercial software including crypto libraries and browsers

Sources: Help Net Security

Drupal highly critical SQL injection on PostgreSQL sites (SA-CORE-2026-004)

A SQL injection in the database abstraction layer affects Drupal sites running PostgreSQL and can be reached anonymously. Drupal raised the risk on 22 May because exploit attempts were detected, and fixed releases are 11.3.10, 11.2.12, 10.6.9 and 10.5.10.

Affected: Drupal 8.9.0 to before 10.4.10, 10.5 before 10.5.10, 10.6 before 10.6.9, 11.0 to before 11.1.10, 11.2 before 11.2.12, 11.3 before 11.3.10 (PostgreSQL only)

• CVE-2026-9082

Sources: Drupal.org, CISA KEV catalog feed

@antv npm wave: 639 malicious versions across 323 packages in one hour

A compromised maintainer account published 639 versions across 323 packages, including popular charting libraries and echarts-for-react, with a Bun-based preinstall hook. echarts-for-react alone sees about 1.1 million weekly downloads.

Affected: @antv/g2, g6, x6, l7, s2, f2 and related packages, echarts-for-react, timeago.js

Sources: Unit 42

Burst Statistics: critical flaw under active attack (CVE-2026-8181)

Burst Statistics (200,000 active installs) had a critical authentication bypass that lets attackers impersonate administrators. Versions 3.4.0 to 3.4.1.1 are affected, 3.4.2 fixes it and attacks followed, with over 112,800 attempts blocked by early June.

Affected: Burst Statistics 3.4.0 - 3.4.1.1, fixed in 3.4.2

• CVE-2026-8181

Sources: Wordfence, Wordfence

NGINX Rift: rewrite module heap overflow exploited within days of the PoC

A heap overflow in the rewrite module, found with an AI-native detection platform, can be triggered by a crafted request when rewrite rules combine unnamed captures with a question mark. VulnCheck saw exploitation attempts from 16 May, three days after a public proof of concept, and Censys counted about 5.7 million exposed nginx servers running a potentially vulnerable version.

Affected: nginx open source 0.6.27 to 1.30.0, NGINX Plus R32 to R36; fixed in 1.30.1 and 1.31.0

• CVE-2026-42945

Sources: Help Net Security, nginx.org, nginx.org changes

Avada Builder (Fusion Builder): high severity flaw (CVE-2026-4782)

Avada Builder (Fusion Builder) (1,000,000 active installs) had an arbitrary file read flaw and an SQL injection. Fixed releases are 3.15.2 and 3.15.3.

Affected: Avada (Fusion) Builder up to 3.15.2, fixed in 3.15.3

• CVE-2026-4782
• CVE-2026-4798

Sources: Wordfence

TanStack npm packages compromised in Mini Shai-Hulud wave

Attackers published 84 malicious versions across 42 @tanstack packages by abusing a GitHub Actions workflow, so the releases even carried valid provenance. The wave spread to more than 160 package versions and CISA listed the TanStack compromise as exploited on 27 May.

Affected: 42 @tanstack/* packages including @tanstack/react-router; TanStack Query, Table, Form not affected

• CVE-2026-45321

Sources: Endor Labs, Unit 42, CISA KEV catalog feed

PrestaShop stored XSS in the back office via the Contact Us form

An unauthenticated visitor can submit a malicious email address through the public contact form that runs script when staff open the customer thread in the back office. That can lead to session hijacking and back office takeover, and fixes are 8.2.6 and 9.1.1.

Affected: PrestaShop before 8.2.6 and 9.0.0 to before 9.1.1

• CVE-2026-44212

Sources: GitLab Advisory Database

PHP 8.5.6 fixes 11 issues including FPM status XSS and SOAP use-after-free

The May release fixed eleven problems, including cross-site scripting in the FPM status page, several use-after-free and null-pointer bugs in SOAP and mbstring, and SQL injection through NUL bytes in the Firebird PDO driver. Sites that expose the FPM status endpoint or use SOAP were most affected.

Affected: PHP 8.5 before 8.5.6 (changelog lists the 8.5 branch)

• CVE-2026-6735
• CVE-2026-7263
• CVE-2026-7259
• CVE-2026-6104

Sources: PHP ChangeLog

Next.js May release fixes 13 advisories, four authentication bypasses rated high

The release closed four high severity bypasses of proxy or middleware authorisation, several denial of service issues, an SSRF with WebSocket upgrades and cache poisoning in RSC responses. Fixed versions are 15.5.18 and 16.2.6, and the upstream React Server Components DoS is CVE-2026-23870.

Affected: Next.js 13.x and 14.x (all versions), 15.x up to 15.5.17, 16.x up to 16.2.5; react-server-dom 19.0.x to 19.0.5, 19.1.x to 19.1.6, 19.2.x to 19.2.5

• CVE-2026-23870

Sources: Vercel changelog

Slider Revolution 7: high severity flaw (CVE-2026-6692)

Slider Revolution 7 (5,000,000 active installs) had an authenticated arbitrary file upload. Versions 7.0.0 to 7.0.10 are affected and 7.0.11 fixes it.

Affected: Slider Revolution 7.0.0 - 7.0.10, fixed in 7.0.11

• CVE-2026-6692

Sources: Wordfence

Breeze Cache: critical flaw under active attack (CVE-2026-3844)

Breeze Cache (400,000 active installs) had a critical unauthenticated arbitrary file upload under active exploitation. Disclosed on 22 April 2026, versions up to 2.4.4 are affected and 2.4.5 fixes it.

Affected: Breeze Cache up to 2.4.4, fixed in 2.4.5

• CVE-2026-3844

Sources: Wordfence

Apache httpd 2.4.67 fixes 11 CVEs including an HTTP/2 double free

The one important issue was an HTTP/2 double free with possible code execution after an early reset, which affected 2.4.66. The release also fixed several mod_proxy_ajp memory bugs.

Affected: Apache HTTP Server 2.4.66 for the HTTP/2 issue; most others through 2.4.66

• CVE-2026-23918
• CVE-2026-24072
• CVE-2026-33006

Sources: Apache HTTP Server project

Mini Shai-Hulud hits SAP CAP npm packages with a preinstall hook

Four SAP related npm packages were published with a preinstall script that ran a loader, reaching about 570,000 combined weekly downloads. It marked the start of the Mini Shai-Hulud series that followed in May.

Affected: @cap-js/sqlite 2.2.2, @cap-js/postgres 2.2.2, @cap-js/db-service 2.10.1, mbt 1.2.48

Sources: Unit 42

cPanel and WHM authentication bypass exploited since February

A CRLF injection in the login flow lets a single crafted request bypass authentication on cPanel and WHM, and attackers used it from at least 23 February, before the patch of 28 April. CISA listed it on 30 April and Shadowserver saw about 44,000 unique IPs scanning or exploiting.

Affected: All cPanel and WHM versions after 11.40 and WP Squared 136.1.7 before patched builds

• CVE-2026-41940

Sources: Help Net Security, CISA KEV catalog feed

Malicious @bitwarden/cli release published for about 90 minutes

A trojanised @bitwarden/cli 2026.4.0 with a preinstall script was live for around an hour and a half. It belonged to a wider campaign that also hit Docker Hub, GitHub Actions and VS Code extensions.

Affected: @bitwarden/cli 2026.4.0

Sources: Unit 42

Kali Forms: critical flaw under active attack (CVE-2026-3584)

Kali Forms (10,000 active installs) had a remote code execution flaw that attackers exploit heavily. Version 2.4.10 fixes releases up to 2.4.9 and Wordfence has blocked more than 312,200 attempts.

Affected: Kali Forms up to 2.4.9, fixed in 2.4.10

• CVE-2026-3584

Sources: Wordfence

Two thirds of WordPress vulnerability reports now use AI

Wordfence reports that the share of reports where the researcher used some AI rose from 16 percent in late November 2025 to about 66 percent by spring 2026. Report volume rose 453 percent since October 2025, which pushed the team to triage with agents.

Affected: WordPress plugin and theme ecosystem

Sources: Wordfence

Ninja Forms File Upload: critical flaw under active attack (CVE-2026-0740)

Ninja Forms File Upload (50,000 active installs) had an unauthenticated arbitrary file upload that attackers began exploiting. Version 3.3.27 fixes releases up to 3.3.26 and more than 118,600 attacks were blocked by mid April.

Affected: Ninja Forms File Upload up to 3.3.26, fixed in 3.3.27

• CVE-2026-0740

Sources: Wordfence, Wordfence

Perfmatters: high severity flaw (CVE-2026-4350)

Perfmatters (200,000 active installs) had an arbitrary file deletion vulnerability. Versions up to 2.5.9.1 are affected and 2.6.0 fixes it.

Affected: Perfmatters up to 2.5.9.1, fixed in 2.6.0

• CVE-2026-4350

Sources: Wordfence

MW WP Form: high severity flaw (CVE-2026-4347)

MW WP Form (200,000 active installs) had an arbitrary file move vulnerability. Versions up to 5.1.0 are affected and 5.1.1 fixes it.

Affected: MW WP Form up to 5.1.0, fixed in 5.1.1

• CVE-2026-4347

Sources: Wordfence

axios npm package compromised, malicious versions dropped a remote access trojan

A hijacked maintainer account published axios 1.14.1 and 0.30.4 with a hidden dependency that installed a cross-platform remote access trojan, live for about three hours. Google attributed the activity to North Korea linked UNC1069 and axios has more than 80 million weekly downloads.

Affected: axios 1.14.1 and 0.30.4 (safe: 1.14.0, 0.30.3)

Sources: Field Effect, Unit 42

Smart Slider 3: medium severity flaw (CVE-2026-3098)

Smart Slider 3 (800,000 active installs) had an arbitrary file read vulnerability. Versions up to 3.5.1.33 are affected and 3.5.1.34 fixes it.

Affected: Smart Slider 3 up to 3.5.1.33, fixed in 3.5.1.34

• CVE-2026-3098

Sources: Wordfence

Node.js March security release fixes 9 CVEs including remote crash bugs

Two high issues let a remote client crash a Node.js server, one through a throwing SNICallback and one through a request header named __proto__. The release also fixed a timing leak in HMAC comparison and a V8 hash flooding problem, in 20.20.2, 22.22.2, 24.14.1 and 25.8.2.

Affected: Node.js 20, 22, 24 and 25 lines before 20.20.2, 22.22.2, 24.14.1, 25.8.2

• CVE-2026-21637
• CVE-2026-21710
• CVE-2026-21711
• CVE-2026-21712

Sources: Node.js

nginx 1.29.7 fixes buffer overflows in WebDAV and MP4 modules plus mail issues

The release fixed buffer overflows in the DAV and MP4 modules, header injection in the mail auth_http handling and an OCSP bypass in the stream module. These matter mainly for servers that enable those modules.

Affected: nginx up to 1.29.6

• CVE-2026-27654
• CVE-2026-27784
• CVE-2026-32647
• CVE-2026-28753

Sources: nginx.org, nginx.org changes

Laravel Livewire code injection added to CISA exploited list

CISA listed a Livewire code injection flaw that lets unauthenticated attackers run commands in specific scenarios. Livewire powers many Laravel apps, so teams should check their Livewire version against the vendor advisory.

Affected: Laravel Livewire (affected versions per vendor advisory)

• CVE-2025-54068

Sources: CISA KEV catalog feed

Craft CMS code injection added to CISA exploited list

CISA listed a Craft CMS code injection that lets a remote attacker run arbitrary code. Owners of Craft sites should confirm they are on a patched release.

Affected: Craft CMS (affected versions per vendor advisory)

• CVE-2025-32432

Sources: CISA KEV catalog feed

WordPress 6.9.2 fixes 10 security issues including blind SSRF and PclZip traversal

The release closed ten issues, including a blind SSRF, an authorization bypass in attachment queries, a PclZip path traversal, XSS in nav menus and an XXE in the bundled getID3 library. Fixes are backported to all branches eligible for security updates.

Affected: WordPress before 6.9.2 (backports to older branches)

Sources: WordPress.org

Ally: high severity flaw (CVE-2026-2413)

Ally (400,000 active installs) had an unauthenticated SQL injection. Versions up to 4.0.3 are affected and 4.1.0 fixes it.

Affected: Ally up to 4.0.3, fixed in 4.1.0

• CVE-2026-2413

Sources: Wordfence

Tutor LMS Pro: critical flaw (CVE-2026-0953)

Tutor LMS Pro (30,000 active installs) had an authentication bypass. Versions up to 3.9.5 are affected and 3.9.6 fixes it.

Affected: Tutor LMS Pro up to 3.9.5, fixed in 3.9.6

• CVE-2026-0953

Sources: Wordfence

WPvivid Backup: critical flaw (CVE-2026-1357)

WPvivid Backup (800,000 active installs) had an arbitrary file upload vulnerability. Wordfence rated it 9.8 and urged users to move to the patched release.

Affected: WPvivid Backup versions before the patched release named in the Wordfence post

• CVE-2026-1357

Sources: Wordfence

Study: AI agents solved 9 of 10 realistic web hacking challenges

Wiz and Irregular tested Claude Sonnet 4.5, GPT-5 and Gemini 2.5 Pro on ten lab challenges modelled on real web flaws, and all three solved the same nine, mostly for under a dollar. The agents struggled with broad enumeration, and in a real incident an hour of agent work found nothing while a human got in within minutes.

Affected: Web applications (lab challenges)

Sources: Wiz

React Server Components denial of service CVE-2026-23864

A further denial of service issue in React Server Components was disclosed on 26 January after the December 2025 fixes, rated high at CVSS 7.5. Operators running server functions should keep React and their framework on the latest patched release.

Affected: react-server-dom-webpack, parcel and turbopack packages (see React advisory)

• CVE-2026-23864

Sources: React

eslint-config-prettier malicious package added to CISA exploited list

CISA listed an embedded malicious code issue in eslint-config-prettier, where installing an affected package ran an install script that launched a Windows malware DLL. It shows how a trusted developer dependency can carry malware into build machines.

Affected: eslint-config-prettier affected versions (CVE-2025-54313)

• CVE-2025-54313

Sources: CISA KEV catalog feed

LA-Studio Element Kit for Elementor: critical flaw (CVE-2026-0920)

LA-Studio Element Kit for Elementor (20,000 active installs) had a backdoor that lets unauthenticated attackers create administrator users. The vendor released a patch on 14 January 2026, one day after Wordfence passed on the details.

Affected: LA-Studio Element Kit for Elementor before the patch of 14 January 2026

• CVE-2026-0920

Sources: Wordfence

Advanced Custom Fields: Extended: critical flaw (CVE-2025-14533)

Advanced Custom Fields: Extended (100,000 active installs) had a privilege escalation vulnerability. Wordfence rated it 9.8 and users should update to the latest release.

Affected: Advanced Custom Fields: Extended before the patched release named in the Wordfence post

• CVE-2025-14533

Sources: Wordfence

Node.js January security release fixes 8 CVEs, three rated high

Three high issues were fixed: uninitialised memory handed out by Buffer.alloc under timing conditions, a symlink trick that bypassed the permission model and a malformed HTTP/2 frame that crashes the server. Fixed versions are 20.20.0, 22.22.0, 24.13.0 and 25.3.0.

Affected: Node.js 20, 22, 24 and 25 lines before 20.20.0, 22.22.0, 24.13.0, 25.3.0

• CVE-2025-55131
• CVE-2025-55130
• CVE-2025-59465
• CVE-2025-59466

Sources: Node.js

Demo Importer Plus: high severity flaw (CVE-2025-14364)

Demo Importer Plus (10,000 active installs) had a flaw that allows a full site reset and privilege escalation. Wordfence firewall protection was in place and users should update to the patched release.

Affected: Demo Importer Plus before the patched release named in the Wordfence post

• CVE-2025-14364

Sources: Wordfence

PHP 8.5.1 fixes array_merge heap overflow and getimagesize memory leak

The first bugfix release of the 8.5 line fixed a heap buffer overflow in array_merge, a memory information leak in getimagesize and a PDO quoting null dereference. It also fixed a null byte termination problem in dns_get_record.

Affected: PHP 8.5.0 (changelog lists the 8.5 branch)

• CVE-2025-14178
• CVE-2025-14177
• CVE-2025-14180
• CVE-2025-67899

Sources: PHP ChangeLog

Apache httpd 2.4.66 fixes five CVEs including an SSI exec injection

The release fixed query string handling in Server Side Includes exec, NTLM leakage through UNC paths on Windows and a mod_userdir plus suexec bypass. All five are rated moderate or low.

Affected: Apache HTTP Server before 2.4.66

• CVE-2025-58098
• CVE-2025-59775
• CVE-2025-66200
• CVE-2025-55753

Sources: Apache HTTP Server project

Sneeit Framework: critical flaw under active attack (CVE-2025-6389)

Sneeit Framework (1,700 active installs) had a remote code execution vulnerability that was exploited the day it was disclosed. It is bundled in several premium themes, version 8.4 fixes it and more than 131,000 attempts were blocked.

Affected: Sneeit Framework (slug sneeit-framework) before 8.4

• CVE-2025-6389

Sources: Wordfence

React2Shell: critical RCE in React Server Components (CVSS 10)

A flaw in how React decodes payloads sent to Server Function endpoints gives unauthenticated remote code execution, even for apps that define no server functions if they support Server Components. Fixes are 19.0.1, 19.1.2 and 19.2.1, and CISA listed it as exploited on 5 December.

Affected: react-server-dom-webpack, -parcel, -turbopack 19.0.0, 19.1.0 to 19.1.1, 19.2.0; affects next, react-router, waku and others

• CVE-2025-55182
• CVE-2025-66478

Sources: React, CISA KEV catalog feed

King Addons for Elementor: critical flaw under active attack (CVE-2025-8489)

King Addons for Elementor (10,000 active installs) had a privilege escalation that attackers actively exploit. More than 48,400 exploit attempts had been blocked by Wordfence.

Affected: King Addons for Elementor before the patched release

• CVE-2025-8489

Sources: Wordfence

Advanced Custom Fields: Extended: critical flaw (CVE-2025-13486)

Advanced Custom Fields: Extended (100,000 active installs) had a remote code execution vulnerability. Wordfence rated it 9.8 and users should update to the patched release.

Affected: Advanced Custom Fields: Extended before the patched release named in the Wordfence post

• CVE-2025-13486

Sources: Wordfence

Shai-Hulud 2.0 worm spreads through npm and GitHub

The second wave of the self-propagating worm ran a preinstall script that stole npm, GitHub and cloud credentials with TruffleHog and used them to publish more infected packages. Wiz counted over 25,000 developers with exposed secrets within three days, and victims included Zapier, Postman, AsyncAPI and PostHog packages.

Affected: Hundreds of npm packages including posthog-node, posthog-js and posthog-react-native

Sources: The Register, Elastic

Cloudflare outage took many websites offline for almost six hours

A database permissions change doubled the size of a Bot Management feature file, which exceeded a limit in the proxy and crashed it across the network. Cloudflare says it was not an attack, and service was normal again by 17:06 UTC.

Affected: Cloudflare CDN, Workers KV, Access, Turnstile and dashboard

Sources: Cloudflare

First reported AI-orchestrated espionage campaign used Claude Code on ~30 targets

Anthropic reported disrupting a campaign that experts believe was likely run by a Chinese state entity, where attackers posing as security testers had Claude Code do most of the reconnaissance, exploit work and data collection. The model sometimes invented results, which limited full autonomy.

Affected: About 30 organisations: technology, chemical, finance and government

Sources: Anthropic, ForkLog report on Anthropic's disclosure

AI Engine: critical flaw (CVE-2025-11749)

AI Engine (100,000 active installs) had a privilege escalation caused by sensitive information exposure. Wordfence rated it 9.8 and sites should run the patched release.

Affected: AI Engine before the patched release named in the Wordfence post

• CVE-2025-11749

Sources: Wordfence

Post SMTP: critical flaw under active attack (CVE-2025-11833)

Post SMTP (400,000 active installs) had an account takeover flaw through email log disclosure that needs no login. Attacks followed and by 19 November Wordfence had blocked more than 10,300 exploit attempts.

Affected: Post SMTP before the patched release named in the Wordfence post

• CVE-2025-11833

Sources: Wordfence, Wordfence