Hackers are chaining together two newly discovered flaws to achieve remote code execution.

WordPress WP2Shell vulnerabilities expose millions of unpatched sites to full remote takeover - update to 7.0.2 now to stay ...

Attackers are exploiting two WordPress flaws as wp2shell, chaining them for unauthenticated RCE and deploying web shells and ...

Administrators are being urged to patch a critical pre-authentication RCE vulnerability in WordPress that threatens millions of websites and which can lead to a full takeover by attackers.

Just hours after fixes came out, attackers have begun exploiting two bugs that, when chained together, allow ...

By chaining an SQL injection and an API vulnerability, attackers can inject code. WordPress has released an update, the ...

Attackers can exploit a critical SQL injection vulnerability found in a widely used WordPress plug-in to compromise more than 1 million sites and extract sensitive data such as password hashes from ...

A WordPress plugin installed on over one million sites has just fixed a severe SQL injection vulnerability that can allow attackers to steal data from a website's database. The vulnerable plugin's ...

A bug exploitable in WordPress 4.8.2 and earlier creates unexpected and unsafe conditions ripe for a SQL-injection attack. A bug exploitable in WordPress 4.8.2 and earlier creates unexpected and ...

A bug discovered in WordPress allows attackers to trigger an SQL injection attack leading to complete website hijacking. The vulnerability was discovered in the WordPress content management system ...