Quick answer: If you downloaded Rank Math PRO version 3.0.123 between October 15 (20:02 UTC) and October 16 (07:12 UTC), your copy may contain a backdoor. If you activated it, treat the site as compromised and follow the cleanup steps below. The free Rank Math plugin from WordPress.org is not affected. What happened For roughly … Read more
According to WordPress security company Patchstack, a critical vulnerability is being exploited in the Bricksforge WordPress plugin. The vulnerability is tracked as CVE-2026-85097 and has a CVSS score of 9.8. Unauthenticated attackers can exploit it to upload arbitrary files and execute malicious code. This allows threat actors to gain full control over the targeted WordPress … Read more
Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two independent WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create fraudulent administrator accounts. Both vulnerabilities were given a high severity rating and require an authenticated session to be exploited. They are tracked as CVE-2026-93836, affecting WPC product bundles for … Read more