Bricksforge's CVE-2026-85097 is under active exploitation and allows unauthenticated PHP execution on affected WordPress ...

WordPress fixes a critical unauthenticated path traversal flaw that can load local PHP files and, on some servers, enable code execution.

CVE-2026-87902: Hackers deployed PHP webshells on WordPress servers within 48 hours of the September 22 security patch, with attack traffic surging tenfold as more than 350,000 sites remain unpatched.

Hackers are actively exploiting CVE-2026-87902, a critical WordPress flaw that can lead to remote code execution. Here’s what admins should do.

This article is a summary of the official announcement. Confirmation date: 2026-09-30 (Confirmation date of 00_seed.md). Screens and conditions may change.Table of Contents Introduction What was annou ...

Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component ...