Technology 15 sources · over 7 days 118 articles

Critical Vulnerabilities in Major WordPress Plugins Expose Millions of Sites to Attack

A series of severe security flaws in widely used WordPress plugins has put millions of websites at risk of remote code execution, site takeovers, and unauthorized access, prompting urgent calls for updates.

Read the full story → · Latest coverage 5 Sept 2026, 9:50 am UTC

Key moments · 10

Forminator Forms plugin flaw exposes 600,000 sites

DEV Community ↗

Privilege escalation vulnerability found in Pods plugin

Wordfence ↗

Everest Forms vulnerability allows complete site takeover

Cyber Security News ↗

Critical miniOrange SAML flaws allow admin account hijacking

GBHackers On Security ↗

WPMU DEV Dashboard plugin flaw enables admin access

GBHackers On Security ↗

Critical GiveWP vulnerability allows server command execution

Security Affairs ↗

All-in-One WP Migration plugin SQL injection affects millions

Wordfence ↗

Critical Elementor Pro flaw exploited in the wild

BleepingComputer ↗

Super Forms plugin RCE flaw actively exploited

GBHackers On Security ↗

Over 440,000 exploit attempts target Super Forms and Elementor Pro

The Hacker News ↗

Coverage by day

newest first

9 articles

  1. CVE-2026-32475: Unauthenticated RCE in Elementor Pro via File Upload Validation Bypass
    DEV Community
  2. Critical Super Forms WordPress Flaw Actively Exploited to Achieve Remote Code Execution
    GBHackers On Security
  3. Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws [app] [exp] [mal]
    Talkback.sh - All
  4. Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
    The Hacker News
  5. WordPress WP Rentals theme < 3.16.0 - Insecure Direct Object References (IDOR...
    CVE | THREATINT - NEW

8 articles

  1. Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin
    Wordfence
  2. WordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.5 - Broken Ac...
    CVE | THREATINT - NEW
  3. Critical Elementor Pro flaw exploited to take over WordPress sites
    BleepingComputer
  4. SQL injection vulnerability in WordPress plugin affects millions of sites
    SC World
  5. Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability
    SecurityWeek

3 articles

  1. WordPress backup plugin flaw exposes millions of sites to takeover attacks
    BleepingComputer
  2. SEOWriting WordPress Plugin 1.12.5 Stored XSS via iframe onloadSEOWriting plu...
    CVE | THREATINT - NEW
  3. WP File Download <= 6.3.4 - Authenticated (Subscriber+) Arbitrary File Deleti...
    CVE | THREATINT - NEW

6 articles

  1. 5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
    Wordfence
  2. WPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Sit...
    CVE | THREATINT - NEW
  3. MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Comple...
    CVE | THREATINT - NEW
  4. User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting v...
    CVE | THREATINT - NEW
  5. Frontend Admin by DynamiApps <= 3.29.11 - Authenticated (Contributor+) Stored...
    CVE | THREATINT - NEW

5 articles

  1. WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerabilityMissin...
    CVE | THREATINT - NEW
  2. Critical GiveWP Flaw Lets Attackers Run Commands on WordPress Servers
    Security Affairs
  3. Keep Backup Daily WordPress Plugin < 2.1.4 Sensitive Information Exposure via...
    CVE | THREATINT - NEW
  4. ProfilePress WordPress Plugin < 4.17.2 Unauthenticated Arbitrary Plugin Insta...
    CVE | THREATINT - NEW
  5. WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerabilityMissi...
    CVE | THREATINT - NEW