{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T12:59:41.857Z",
  "stack": {
    "id": "wordpress",
    "label": "WordPress",
    "kind": "ecosystem",
    "url": "https://pwn.watch/s/wordpress",
    "feed": "https://pwn.watch/s/wordpress/feed.xml"
  },
  "counts": {
    "incidents": 5,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 4
  },
  "incidents": [
    {
      "slug": "updraftcentral-keys-wordpress-backdoor",
      "title": "TeamUpdraft / UpdraftCentral keys stolen; WordPress sites backdoored",
      "url": "https://pwn.watch/i/updraftcentral-keys-wordpress-backdoor",
      "json": "https://pwn.watch/i/updraftcentral-keys-wordpress-backdoor.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "partial",
      "product": "UpdraftPlus / UpdraftCentral (WordPress)",
      "stacks": [
        "php",
        "wordpress"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Sites with stolen UpdraftCentral connection keys"
      ],
      "fixedVersions": [],
      "startedAt": "2026-10-18",
      "closedAt": "2026-10-20",
      "updatedAt": "2026-10-20",
      "summary": "UK plugin maker TeamUpdraft said attackers breached its website, stole UpdraftCentral connection keys, and used them to backdoor WordPress sites running UpdraftPlus/UpdraftCentral."
    },
    {
      "slug": "rank-math-pro-wordpress-backdoor",
      "title": "Rank Math PRO WordPress plugin download backdoored",
      "url": "https://pwn.watch/i/rank-math-pro-wordpress-backdoor",
      "json": "https://pwn.watch/i/rank-math-pro-wordpress-backdoor.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Rank Math PRO (WordPress)",
      "stacks": [
        "php",
        "wordpress"
      ],
      "cveIds": [],
      "affectedVersions": [
        "3.0.123 (compromised download window)"
      ],
      "fixedVersions": [
        "Clean PRO builds after incident"
      ],
      "startedAt": "2026-10-15",
      "closedAt": "2026-10-16",
      "updatedAt": "2026-10-16",
      "summary": "SEO plugin vendor Rank Math confirmed attackers tampered with PRO version 3.0.123 on the official download site, planting hidden backdoors during an ~11-hour window. Sites that installed that build should audit and rebuild."
    },
    {
      "slug": "wordpress-core-cve-2026-87902",
      "title": "WordPress Core: WordPress Core Remote File Inclusion Vulnerability",
      "url": "https://pwn.watch/i/wordpress-core-cve-2026-87902",
      "json": "https://pwn.watch/i/wordpress-core-cve-2026-87902.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "WordPress Core",
      "stacks": [
        "php",
        "wordpress"
      ],
      "cveIds": [
        "CVE-2026-87902"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-25",
      "closedAt": "2026-09-25",
      "updatedAt": "2026-09-25",
      "summary": "WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Added to CISA KEV on 2026-09-25."
    },
    {
      "slug": "wordpress-core-cve-2026-60137",
      "title": "WordPress Core: WordPress Core SQL Injection Vulnerability",
      "url": "https://pwn.watch/i/wordpress-core-cve-2026-60137",
      "json": "https://pwn.watch/i/wordpress-core-cve-2026-60137.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "WordPress Core",
      "stacks": [
        "php",
        "wordpress"
      ],
      "cveIds": [
        "CVE-2026-60137",
        "CVE-2026-63030"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-07-21",
      "closedAt": "2026-07-21",
      "updatedAt": "2026-07-21",
      "summary": "WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. CISA added CVE-2026-60137, CVE-2026-63030 to the Known Exploited Vulnerabilities catalog on 2026-07-21 based on evidence of active exploitation."
    },
    {
      "slug": "webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940",
      "title": "WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability",
      "url": "https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940",
      "json": "https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "WebPros cPanel & WHM and WP2 (WordPress Squared)",
      "stacks": [
        "wordpress",
        "hosting"
      ],
      "cveIds": [
        "CVE-2026-41940"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-04-30",
      "closedAt": "2026-04-30",
      "updatedAt": "2026-04-30",
      "summary": "WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Added to CISA KEV on 2026-04-30."
    }
  ],
  "changes": [
    {
      "incident": "wordpress-core-cve-2026-87902",
      "incidentTitle": "WordPress Core: WordPress Core Remote File Inclusion Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-25",
      "title": "CISA added CVE-2026-87902 to the KEV catalog (due 2026-09-28).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/wordpress-core-cve-2026-87902"
    },
    {
      "incident": "wordpress-core-cve-2026-60137",
      "incidentTitle": "WordPress Core: WordPress Core SQL Injection Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-07-21",
      "title": "CISA added CVE-2026-60137, CVE-2026-63030 to the KEV catalog (due 2026-08-04).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/wordpress-core-cve-2026-60137"
    },
    {
      "incident": "webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940",
      "incidentTitle": "WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-04-30",
      "title": "CISA added CVE-2026-41940 to the KEV catalog (due 2026-05-03).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/webpros-cpanel-whm-and-wp2-wordpress-squared-cve-2026-41940"
    }
  ]
}