Find a story
Search Spins
Search titles, summaries, and missing voices across published articles — press releases, announcements, and media coverage.
0 results for “WordPress plugin”
Critical Elementor Pro bug exposes WordPress sites to RCE attacks
A critical remote code execution (RCE) vulnerability in Elementor Pro—a widely used WordPress page builder plugin—enables attackers to upload and execute arbitrary files on affected servers, posing immediate compromise risk to millions of WordPress sites.
Aug 21, 2026
Elementor Pro Flaw Could Let Unauthenticated Attackers Upload PHP and Execute Code
A critical remote code execution vulnerability (CVE-2026-32475, CVSS 9.0) was disclosed in Elementor Pro’s Forms module, enabling unauthenticated attackers to upload malicious PHP files.
Aug 20, 2026
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
A critical remote code execution vulnerability (CVE-2026-15748, CVSS 9.8) was disclosed in the Forminator WordPress plugin—used on over 600,000 active sites—allowing unauthenticated attackers to execute arbitrary PHP code via malicious file uploads.
Aug 18, 2026
BdThemes Supply Chain Attack Poisons JSON to Create Rogue WordPress Admins
A supply chain attack compromised BdThemes' WordPress plugins by injecting malicious JSON payloads that created unauthorized administrator accounts, without altering source code in the official WordPress.org repository.
Aug 11, 2026
We built a vulnerability vending machine: AI tokens in, zero-days out
Intruder developed and demonstrated an AI system that automatically discovers and exploits previously unknown software vulnerabilities, including a zero-day in a WordPress plugin, using code slicing and LLMs.
Jul 15, 2026