Tag: plugin-vulnerability

What the TranslatePress Account Takeover Flaw Teaches WordPress Site Owners About Credential Safety

What happened with TranslatePress In August 2026, the security team at Wordfence disclosed an unauthenticated account takeover flaw in TranslatePress, the multilingual plugin with more than 400,000 active installations. A researcher using the handle momopon1415 (Yuto Hyakumoto) submitted the issue through the Wordfence Bug Bounty Program on August 11, 2026. The vendor, Cozmoslabs, acknowledged the […]

Aug 30, 2026 · 5 min read

Security

Critical Object Injection Vulnerability Fixed in SEOPress 7.9

SEOPress 7.9 addresses a critical security flaw that allowed unauthenticated attackers to exploit REST API routes and perform object injection attacks via unserialized post metadata. WordPress site owners should update promptly to mitigate risks.

May 24, 2026 · 5 min read

Security

Critical Unauthenticated Privilege Escalation Vulnerability Found in Profile Builder Plugin

A serious unauthenticated privilege escalation vulnerability has been identified in the widely used Profile Builder plugin, risking unauthorized admin access. The issue has been addressed in version 3.11.9.

May 24, 2026 · 6 min read

Security

Critical Malware Campaign Exploits WP-Automatic Plugin Vulnerability in Over 5 Million Attacks

A critical SQL injection vulnerability in WP-Automatic plugin has led to over 5.5 million attack attempts, enabling attackers to gain admin access and upload malware.

May 17, 2026 · 5 min read