WordPress

WordPress core, plugins and WordPress hosting. Newest first.

HighPartly patched
TeamUpdraft / UpdraftCentral keys stolen; WordPress sites backdoored
UK plugin maker TeamUpdraft said attackers breached its website, stole UpdraftCentral connection keys, and used them to backdoor WordPress sites running UpdraftPlus/UpdraftCentral.
UpdraftPlus / UpdraftCentral (WordPress)Closed Oct 20, 2026updated Oct 20, 2026
CriticalPatched
Rank Math PRO WordPress plugin download backdoored
SEO plugin vendor Rank Math confirmed attackers tampered with PRO version 3.0.123 on the official download site, planting hidden backdoors during an ~11-hour window. Sites that installed that build should audit and rebuild.
Rank Math PRO (WordPress)Closed Oct 16, 2026updated Oct 16, 2026
Sep 25HighWordPress Core: WordPress Core Remote File Inclusion VulnerabilityPatched
WordPress Core Patched
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Added to CISA KEV on 2026-09-25.
Open incident →CVE-2026-87902

Show 3 older incidents

Jul 21HighWordPress Core: WordPress Core SQL Injection VulnerabilityPatched
WordPress Core Patched
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. CISA added CVE-2026-60137, CVE-2026-63030 to the Known Exploited Vulnerabilities catalog on 2026-07-21 based on evidence of active exploitation.
Open incident →CVE-2026-60137 · CVE-2026-63030

Apr 30HighWebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function VulnerabilityPatched
WebPros cPanel & WHM and WP2 (WordPress Squared) Patched
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Added to CISA KEV on 2026-04-30.
Open incident →CVE-2026-41940

Aug 13CriticalLiteSpeed Cache WordPress plugin: unauthenticated admin takeover (CVE-2024-28000)Patched
LiteSpeed Cache (WordPress plugin) Patched
A weak hash in the LiteSpeed Cache plugin's role-simulation feature let unauthenticated attackers brute-force a value and become administrator on WordPress sites. The plugin had 5+ million installs. Fixed in 6.4.
Open incident →CVE-2024-28000

5 WordPress incidents in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore