Fresh WordPress Vulnerability in Attackers’ Crosshairs
Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.
Excerpt from the primary source: SecurityWeek
Who is affected
Small businesses · Developers · Security professionals
Affected technology: WordPress
What you should do · Review
Review whether your organization uses WordPress and assess exposure using the linked advisories.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Original reporting
Related
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
The two RCE bugs can be exploited against WordPress, Drupal, Joomla, and other popular applications.
Stolen UpdraftCentral keys used to backdoor WordPress sites
A threat actor breached TeamUpdraft's website, a developer of popular WordPress backup and security plugins, potentially compromising UpdraftCentral connection keys that can send commands to connected websites.
WordPress SEO plugin Rank Math compromised to backdoor websites
Some downloads of the Rank Math PRO WordPress plugin from the vendor's official website carried malware that planted hidden backdoors in a supply-chain attack last week.
Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack
Hackers injected malware into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16.