UTC on September 22, 2026, the first probe hit, occurring five hours and forty-nine minutes after WordPress 7.1.2 shipped. This rapid transition from patch release to active exploitation confirms the ...

WordPress has released version 7.1.2 to address a critical core vulnerability that could allow unauthenticated attackers to achieve remote code execution under specific server and theme configurations ...

WordPress 7.1.2 patches a critical flaw that could let unauthenticated attackers execute code on vulnerable websites under certain conditions.

WordPress fixes a critical unauthenticated path traversal flaw that can load local PHP files and, on some servers, enable ...

Bluehost’s already excellent web hosting service sweetens the deal with this accessible WordPress-focused website builder ...

WordPress has patched Click2Shell, that could allow an attacker to silently install a theme and execute PHP code on the targeted website.

Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component ...

A newly disclosed WordPress Core vulnerability chain, dubbed Click2Shell, allowed unauthenticated attackers to force a logged ...

WordPress Click2Shell vulnerability lets attackers silently install themes on any admin's site via a single crafted link, ...

WordPress administrators are being urged to update after researchers disclosed Click2Shell, an exploit chain that can turn ...

A high-severity SQL injection flaw in All-in-One WP Migration and Backup — installed on more than 5 million WordPress sites — has a weaponized proof-of-concept exploit circulating in ...