Tag

WordPress

6 stories

Inside the 60,471 Attempts: What the WordPress 7.1.4 Patch Actually Stopped

Hackers flooded WordPress sites with tens of thousands of requests targeting a Core remote code execution (RCE) weakness in the hours after a security patch was released. Wordfence’s threat intelligence recorded 60,471 blocked attempts in a 24‑hour window — a clear signal that attackers were actively probing the update process, even though the majority of those requests were firewall‑blocked and not confirmed compromises. What attackers were trying to exploit The…

Saugata DattaOct 31, 20263 min read112

Cybersecurity

WordPress 7.1.4: Urgent Patch Fixes 22 Flaws, Including an Unauthenticated Update-Time RCE

WordPress pushed out version 7.1.4 on October 28, 2026, closing 22 security flaws and urging site owners to update immediately. The release addresses a range of issues from an unauthenticated remote code execution risk in the update process to multiple stored cross-site scripting and access-control problems. With fixes spanning recent and older branches, the update is a reminder that timely patching remains critical for every WordPress site. The unauthenticated update-time…

Saugata DattaOct 29, 20264 min read147

Cybersecurity

WordPress Imagick RCE (CVE-2026-65640): What Site Owners Need to Know

WordPress has just released a security-focused update — version 7.0.4 — to close a remote code execution flaw that can be triggered when images are processed with the Imagick extension and Ghostscript. The vulnerability, tracked as CVE-2026-65640 and described in GHSA-8vr3-7mxf-gx8w, was responsibly disclosed by researchers at pwn.ai. While exploitation requires an authenticated Author-level account or higher, the bug’s mechanics mean multi-author sites, membership platforms, and installations with broad contributor…

Saugata DattaAug 13, 20264 min read327

Cybersecurity

70% of WordPress Sites Running Outdated PHP Versions, Leaving Millions Exposed

A recent analysis of publicly accessible WordPress installations has revealed a startling reality: a large majority of sites are running PHP versions that are no longer supported, creating a widespread and avoidable security risk. While WordPress itself issues regular updates, the underlying server-side language many sites rely on—PHP—has lagged behind in adoption. The result is an ecosystem where millions of sites are exposed to known vulnerabilities, automated scanning, and opportunistic…

Saugata DattaJul 8, 20264 min read403

Cybersecurity

Critical Flaw in User Registration Membership Plugin (CVE-2026-1492) Lets Attackers Bypass WordPress Authentication

A newly disclosed vulnerability in a popular WordPress plugin can allow attackers to log in as administrators without a username or password. Tracked as CVE-2026-1492 and carrying a CVSS v4.0 score of 9.8, the flaw affects all versions of the User Registration Membership plugin up through 5.1.2. The issue was documented in early March 2026 by CYFIRMA researchers and represents an urgent risk for site owners who rely on the…

Saugata DattaApr 13, 20263 min read674

Cybersecurity

Admin Account Backdoor: Critical Privilege-Flaw in WordPress User Registration Plugin (CVE-2026-1492)

A critical security flaw in a widely used WordPress membership plugin has made it trivially simple for unauthenticated attackers to create administrator accounts and seize control of affected sites. The vulnerability, tracked as CVE-2026-1492, exposes a systemic weakness in how the plugin handled role assignment during user registration. This post summarizes what happened, who discovered it, the immediate risks, and the concrete steps site owners should take now. What the…

Saugata DattaMar 6, 20263 min read974

Inside the 60,471 Attempts: What the WordPress 7.1.4 Patch Actually Stopped

WordPress 7.1.4: Urgent Patch Fixes 22 Flaws, Including an Unauthenticated Update-Time RCE

WordPress Imagick RCE (CVE-2026-65640): What Site Owners Need to Know

70% of WordPress Sites Running Outdated PHP Versions, Leaving Millions Exposed

Critical Flaw in User Registration Membership Plugin (CVE-2026-1492) Lets Attackers Bypass WordPress Authentication

Admin Account Backdoor: Critical Privilege-Flaw in WordPress User Registration Plugin (CVE-2026-1492)

Free Tools: IP, DNS, SSL