WordPress Click2Shell vulnerability lets attackers silently install themes on any admin’s site via a single crafted link, ...

Tracked as CVE-2026-87902, the path traversal flaw allows remote, unauthenticated attackers to execute arbitrary code.

Hackers are actively exploiting CVE-2026-87902, a critical WordPress flaw that can lead to remote code execution. Here’s what admins should do.

Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed.

The hole, which allows an unauthenticated attacker to perform remote code execution, is especially dangerous because many enterprises are not aware of all of their WordPress sites.

Unauthenticated users can run remote code, putting millions of websites at risk. Learn how to protect your site now.

A high-severity SQL injection flaw in All-in-One WP Migration and Backup — installed on more than 5 million WordPress sites — has a weaponized proof-of-concept exploit circulating in ...

WordPress has released version 7.1.2 to address a critical core vulnerability that could allow unauthenticated attackers to achieve remote code execution under specific server and theme configurations ...

The very first developments of the Met Gala 2027 are here! (Sorry if you were still getting over Beyoncé and Blue Ivy shutting down the red carpet together this year!) Every year as May rolls around, ...

A CVSS 9.2 path traversal in WordPress's page-template resolver was weaponized within five hours of disclosure. The patch-gap pattern has reached the most-deployed CMS on the web.

September 25, 2026 • When Rep. Jasmine Crockett took the stage at a Chris Brown concert to honor him, the backlash came fast. It's a familiar cycle: every few years, Brown lands back in the news, and ...