A threat actor has breached the website of TeamUpdraft, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral’s connection keys, which can send commands to connected websites. TeamUpdraft discovered unauthorized access to its infrastructure over the weekend and believes the hacker accessed the customer database. The developer offers several WordPress tools for … Read more
Quick answer: If you downloaded Rank Math PRO version 3.0.123 between October 15 (20:02 UTC) and October 16 (07:12 UTC), your copy may contain a backdoor. If you activated it, treat the site as compromised and follow the cleanup steps below. The free Rank Math plugin from WordPress.org is not affected. What happened For roughly … Read more
According to WordPress security company Patchstack, a critical vulnerability is being exploited in the Bricksforge WordPress plugin. The vulnerability is tracked as CVE-2026-85097 and has a CVSS score of 9.8. Unauthenticated attackers can exploit it to upload arbitrary files and execute malicious code. This allows threat actors to gain full control over the targeted WordPress … Read more
Hackers are exploiting stored cross-site scripting (XSS) vulnerabilities in two independent WordPress plugins, Ninja Forms and WPC Product Bundles for WooCommerce, to install backdoors and create fraudulent administrator accounts. Both vulnerabilities were given a high severity rating and require an authenticated session to be exploited. They are tracked as CVE-2026-93836, affecting WPC product bundles for … Read more