pwn.watch: WordPress incident updates

[high] TeamUpdraft / UpdraftCentral keys stolen; WordPress sites backdoored

Tue, 20 Oct 2026 00:00:00 GMT

UK plugin maker TeamUpdraft said attackers breached its website, stole UpdraftCentral connection keys, and used them to backdoor WordPress sites running UpdraftPlus/UpdraftCentral.

Status: closed · Patch: partial

[critical] Rank Math PRO WordPress plugin download backdoored

Fri, 16 Oct 2026 00:00:00 GMT

SEO plugin vendor Rank Math confirmed attackers tampered with PRO version 3.0.123 on the official download site, planting hidden backdoors during an ~11-hour window. Sites that installed that build should audit and rebuild.

Status: closed · Patch: patched · Fixed in: Clean PRO builds after incident

[high] WordPress Core: WordPress Core Remote File Inclusion Vulnerability

Fri, 25 Sep 2026 00:00:00 GMT

WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Added to CISA KEV on 2026-09-25.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-25: CISA added CVE-2026-87902 to the KEV catalog (due 2026-09-28).

CVEs: CVE-2026-87902

[high] WordPress Core: WordPress Core SQL Injection Vulnerability

Tue, 21 Jul 2026 00:00:00 GMT

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. CISA added CVE-2026-60137, CVE-2026-63030 to the Known Exploited Vulnerabilities catalog on 2026-07-21 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-07-21: CISA added CVE-2026-60137, CVE-2026-63030 to the KEV catalog (due 2026-08-04).

CVEs: CVE-2026-60137, CVE-2026-63030

[high] WebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability

Thu, 30 Apr 2026 00:00:00 GMT

WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Added to CISA KEV on 2026-04-30.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-04-30: CISA added CVE-2026-41940 to the KEV catalog (due 2026-05-03).

CVEs: CVE-2026-41940

[critical] LiteSpeed Cache WordPress plugin: unauthenticated admin takeover (CVE-2024-28000)

Wed, 21 Aug 2024 00:00:00 GMT

A weak hash in the LiteSpeed Cache plugin's role-simulation feature let unauthenticated attackers brute-force a value and become administrator on WordPress sites. The plugin had 5+ million installs. Fixed in 6.4.

Status: closed · Patch: patched · Fixed in: 6.4

Latest updates:

2024-08-21: Patchstack publishes details (source)
2024-08-13: LiteSpeed Cache 6.4 released with the fix (source)

CVEs: CVE-2024-28000