WordPress News & Coverage
Patchstack is restructuring its bug bounty program to focus on high-impact vulnerabilities in WordPress, reducing low-value AI-generated reports and duplicates. The changes, effective June 2026, prioritize unauthenticated or low-privilege exploits, helping agencies and site operators better allocate security resources.
WordPress VIP has earned the Secure Hosting Alliance certification, affirming its commitment to enterprise-grade security, reliability, and privacy. This independent validation offers WordPress professionals a trusted benchmark when choosing managed WordPress hosting for mission-critical projects.
SEOPress 7.9 addresses a critical security flaw that allowed unauthenticated attackers to exploit REST API routes and perform object injection attacks via unserialized post metadata. WordPress site owners should update promptly to mitigate risks.
A serious unauthenticated privilege escalation vulnerability has been identified in the widely used Profile Builder plugin, risking unauthorized admin access. The issue has been addressed in version 3.11.9.
An unpatched SQL injection vulnerability in TI WooCommerce Wishlist plugin affects 100,000+ sites, allowing unauthenticated attackers to compromise WordPress databases.
A persistent WordPress malware campaign exploits the deprecated php-everywhere plugin to embed malicious PHP code in posts, creating long-term infections beyond file cleanup.
A wave of JavaScript malware is exploiting vulnerable LiteSpeed Cache plugin versions below 5.7.0.1, injecting malicious code and creating unauthorized admin users.
Vulnerability scanners tailored for WordPress detect plugin and theme flaws before hackers exploit them. We review the 10 best scanners for effective WordPress security.
Discover 10 top website security tools tailored for WordPress enterprises to proactively detect vulnerabilities, automate scans, and respond fast to threats.
