WordPress Core RCE under mass attack; update to 7.1.4 now
Wordfence logged 62,969 attacks in 24h against an unauthenticated RCE in WordPress Core 4.7–7.1.3 (GHSA-4w3m-c66w-69mg, CVSS 8.1). Fixed in 7.1.4. Patch and hunt wp-content/upgrade.
Stories tagged: #wordpress
TeamUpdraft breach exposes UpdraftCentral keys to takeover
TeamUpdraft says its customer database was accessed on Oct 17–18, exposing UpdraftCentral connection keys that can push plugins to linked WordPress sites. Delete keys now.
Rank Math PRO 3.0.123 shipped a self-restoring backdoor
Rank Math PRO 3.0.123 (CVE-2026-111862, CVSS 9.8) was served with a self-restoring backdoor during a 15–16 Oct window. Delete the plugin, clean the install, rotate everything.
Ghostscript RCE via crafted PDF patched (CVE-2026-39919)
CVE-2026-39919, a heap buffer overflow in Ghostscript's JPEG 2000 adapter, lets a crafted PDF trigger RCE. Fixed in 10.08.0; Wordfence demoed unauth RCE on WordPress, no in-the-wild abuse yet.
Bricksforge WordPress plugin RCE exploited within days (CVE-2026-85097)
CVE-2026-85097, an unauthenticated arbitrary file upload in the Bricksforge plugin, is under active exploitation. Patch to 3.1.8.10. Patchstack saw attacks from October 7.
WordPress 'SC' malware self-heals via eight footholds, blockchain C2
Sucuri details 'SC,' a WordPress backdoor that rebuilds itself from eight files plus a DB drop-in and shared memory, and reads C2 instructions from Ethereum smart contracts.
WordPress patches wp2shell pre-auth RCE in 7.0.2 and 6.9.5
WordPress 7.0.2 and 6.9.5 shipped July 17 to close CVE-2026-63030 — a pre-auth RCE in Core built on the CVE-2026-60137 SQL injection. Detection PoC is already public.
Gravity SMTP CVE-2026-4020: API keys leaked, 17M exploit attempts
Wordfence blocked 17M attempts at the unauth REST endpoint that dumps Gravity SMTP's full System Report — live API keys and OAuth tokens included. Patch is 2.1.5.
Everest Forms Pro CVE-2026-3300 exploited since April 13 to plant rogue admins
Wordfence's firewall blocked 29,300+ exploit attempts against a CVSS 9.8 PHP-eval RCE in Everest Forms Pro. Sites pre-1.9.13 should hunt for the rogue admin diksimarina.