#wordpress / Page 4

A cross-site request forgery (CSRF) vulnerability in the Elementor plugin for WordPress could allow an unauthenticated attacker to create administrator accounts.

Hackers are actively exploiting CVE-2026-87902, a critical WordPress flaw that can lead to remote code execution. Here's what admins should do. The post WordPress Flaw Under Active Attack: Hackers Target CVE-2026-87902 for Code Execution appeared ...

Join Kinsta in Singapore from October 12 to 15 for Hypergrowth Summit and exclusive networking dinners.

The hole, which allows an unauthenticated attacker to perform remote code execution, is especially dangerous because many enterprises are not aware of all of their WordPress sites.

WordPress flaw that enabled a path to Remote Code Execution (RCE) was patched all the way back to version 4.8, but the real-world attacks have only increased.

See how AI agents are becoming the new WordPress operators, from updates and deployments to monitoring, automation, and agency workflows.

Inside this week's LWN.net Weekly Edition: Front: Git 2.56; gccrs; NetBSD and compat_linux; io_uring; Desktop UX. Briefs: WordPress vulnerability; Radicle vulnerability; Systemtap 5.6; GNOME 51; Systemd v262; Quotes;

Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed.

A critical vulnerability has been discovered in WordPress's get_page_template() function for pa [...]

A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases.