Expert articles on web security, vulnerabilities, and best practices
NewsFive critical vulnerabilities affecting WPMU DEV Dashboard, Avada and Fusion Builder, TranslatePress, Pods, and GiveWP can allow unauthenticated attackers to gain administrator access, expose password-reset credentials, or execute code on vulnerable WordPress servers. Four carry CVSS scores of 9.8, while the GiveWP vulnerability is rated 10.0 by Patchstack.
NewsCVE-2026-32475 is a critical Elementor Pro arbitrary file upload vulnerability affecting versions through 4.2.1. Attackers have actively exploited the flaw to upload executable PHP files to vulnerable WordPress sites, potentially leading to remote code execution and complete site compromise.
NewsCVE-2026-16947 is a critical unauthenticated vulnerability in the Total Processing Card Payments for WooCommerce plugin through version 7.3. Attackers can abuse server-side request forgery to redirect payment verification requests, expose payment-gateway credentials, and potentially mark arbitrary WooCommerce orders as paid.
NewsCVE-2026-9689 is a medium-severity Keycloak vulnerability involving HTTP parameter pollution in OIDC redirect URI handling. Under specific conditions, duplicate authentication parameters can cause client applications to process attacker-controlled values instead of legitimate Keycloak responses.
NewsCVE-2018-0231 is a high-severity TLS vulnerability affecting certain Cisco ASA and Firepower Threat Defense deployments. An unauthenticated remote attacker can send malicious TLS traffic that crashes an affected appliance and causes a denial of service.
NewsWordfence reported an auth bypass in User Profile Builder (about 40,000 installs). Older releases can auto-login as the first WordPress user. Update, review admins, and recheck the public stack.
NewsCVE-2026-32475 in Elementor Pro through 4.2.1 can let a visitor upload PHP via a public form. Update to 4.2.2, inspect the forms upload folder, and review admins.
NewsCVE-2026-9689 is a medium-severity Keycloak vulnerability involving HTTP parameter pollution in OIDC redirect URI handling, potentially allowing attacker-controlled parameters to influence authentication flows.
NewsWordfence reported an unauthenticated privilege-escalation flaw in the Pods WordPress plugin (100,000+ installs). Attackers can become admin and reset the site owner’s password. Update Pods and review users this week.
NewsWordfence reported an unauthenticated file-upload flaw in Elementor Pro (about 6 million installs). Attackers can upload PHP and take over the site. The issue is patched — update and review uploads this week.