Expert articles on web security, vulnerabilities, and best practices
NewsCVE-2026-85097 is a critical unauthenticated arbitrary file upload vulnerability in Bricksforge for WordPress through version 3.1.8.9. Attackers are actively exploiting the flaw to place executable PHP files on vulnerable sites and achieve remote code execution.
NewsCVE-2026-12241 is a medium-severity stored cross-site scripting vulnerability affecting Advanced Woo Labels for WooCommerce through version 2.51. Authenticated users with Contributor-level access or higher can create label content that is rendered without adequate escaping.
NewsCVE-2026-87902 is a critical WordPress core path-traversal flaw that can lead to conditional remote code execution. Active exploitation began within hours of disclosure, making immediate patching and compromise review important.
NewsElementor 4.3.0 and 4.3.1 contain a high-severity CSRF flaw that can let a crafted link trigger privileged WordPress REST actions when opened by a logged-in administrator. Version 4.3.2 fixes the issue.
NewsThe WP2Shell chain combines CVE-2026-60137 and CVE-2026-63030 to turn unauthenticated WordPress flaws into administrator creation and potential remote code execution. Real attack activity has been observed.
NewsCVE-2026-42012 can cause GnuTLS to fall back to Common Name checks for certain URI and SRV SAN certificates, potentially weakening certificate validation and enabling service spoofing or interception.
NewsCVE-2024-5971 is an Undertow denial-of-service flaw affecting a specific Java 17 and TLS 1.3 response-handling scenario. Teams should verify package versions, runtime conditions, and patch status.
NewsCVE-2026-18072 tracks a deliberately introduced authentication backdoor in Advanced Responsive Video Embedder versions 10.8.7 and 10.8.8. The malicious code could grant unauthenticated attackers administrator access using a hardcoded token, making the incident a WordPress software supply-chain compromise rather than a conventional coding bug.
NewsCVE-2026-48595 affects the Elixir Tesla HTTP client when Tesla.Middleware.FollowRedirects is used. Case-sensitive filtering can fail to remove a normally cased Authorization header on a cross-origin redirect, potentially sending bearer tokens or other credentials to an attacker-controlled destination.
NewsCVE-2026-8457 is a critical authentication bypass in the WooCommerce - Social Login plugin for WordPress through version 2.8.7. The Apple login handler decodes identity-token claims without verifying the JWT signature or key claims, allowing an unauthenticated attacker to impersonate existing users, including administrators.