Expert articles on web security, vulnerabilities, and best practices
NewsCVE-2026-16947 is a critical unauthenticated vulnerability in the Total Processing Card Payments for WooCommerce plugin through version 7.3. Attackers can abuse server-side request forgery to redirect payment verification requests, expose payment-gateway credentials, and potentially mark arbitrary WooCommerce orders as paid.
NewsCVE-2026-9689 is a medium-severity Keycloak vulnerability involving HTTP parameter pollution in OIDC redirect URI handling. Under specific conditions, duplicate authentication parameters can cause client applications to process attacker-controlled values instead of legitimate Keycloak responses.
NewsCVE-2018-0231 is a high-severity TLS vulnerability affecting certain Cisco ASA and Firepower Threat Defense deployments. An unauthenticated remote attacker can send malicious TLS traffic that crashes an affected appliance and causes a denial of service.
NewsWordfence reported an auth bypass in User Profile Builder (about 40,000 installs). Older releases can auto-login as the first WordPress user. Update, review admins, and recheck the public stack.
NewsCVE-2026-32475 in Elementor Pro through 4.2.1 can let a visitor upload PHP via a public form. Update to 4.2.2, inspect the forms upload folder, and review admins.
NewsCVE-2026-9689 is a medium-severity Keycloak vulnerability involving HTTP parameter pollution in OIDC redirect URI handling, potentially allowing attacker-controlled parameters to influence authentication flows.
NewsWordfence reported an unauthenticated privilege-escalation flaw in the Pods WordPress plugin (100,000+ installs). Attackers can become admin and reset the site owner’s password. Update Pods and review users this week.
NewsWordfence reported an unauthenticated file-upload flaw in Elementor Pro (about 6 million installs). Attackers can upload PHP and take over the site. The issue is patched — update and review uploads this week.
NewsCISA added CVE-2026-48907 in Joomla Content Editor (JCE) to the KEV catalog. Update JCE past 2.9.99.4, look for unexpected editor profiles, and treat a patched site as unclean until you check it.
NewsGravity SMTP for WordPress (CVE-2026-4020) exposed email API keys without a login. Update past 2.1.4, rotate connector secrets, and review logs for the public REST test route.