Everything CloudSec Pulse has reported about WordPress: 5 stories, newest first. Part of our Vulnerabilities coverage.
Attackers are actively exploiting a CVSS 10.0 vulnerability in Bricksforge to execute code on WordPress sites. Organizations using versions prior to 3.1.8.10 must verify their patch status immediately.
A critical vulnerability in the rtMedia plugin allows attackers to traverse directories, potentially exposing sensitive data on WordPress, BuddyPress, and bbPress sites.
Unauthenticated PHP object injection in Stargaze versions 1.10 and earlier allows attackers to take full control of affected websites.
A critical vulnerability in the ThemeREX Camelia WordPress plugin allows object injection, exposing sites to severe security risks until a patch is released.
A CVSS 9.8 vulnerability in the Booklovers WordPress theme allows attackers to inject objects via untrusted data deserialization, affecting versions up to 2.13.0.