OptinMonster’s CDN was compromised in a supply chain attack affecting approximately 3 million websites. Attackers injected malicious code to steal user data, highlighting critical vulnerabilities in third-party dependencies.

Two critical vulnerabilities in Avada Builder WordPress plugin threaten one million sites with file access and SQL injection attacks. Security researchers urge immediate updates to version 3.15.3.

A critical vulnerability in the WordPress User Registration plugin allows unauthenticated attackers to create admin accounts and take complete control of websites without credentials.

WordPress debug logs can grow to problematic sizes when left unchecked, consuming server resources and affecting site performance. Learn immediate solutions, prevention strategies, and best practices for managing debug logging properly.

WP SQLite DB enables WordPress to run on SQLite databases instead of MySQL. This lightweight solution simplifies WordPress hosting and development by eliminating separate database server requirements.

Pagora AI launches as a WordPress plugin that generates blog posts and social media content from topics. The tool integrates directly into WordPress dashboards for streamlined content creation workflows.

Developer 47Cid releases WP2Shell Lab, an open-source framework for testing WordPress security vulnerabilities in controlled environments. The tool helps security professionals identify exploits before they impact production systems.

Critical WordPress core vulnerability CVE-2026-63030, known as WP2Shell, enables pre-authentication remote code execution. Administrators must implement immediate protective measures and apply security patches.

Exploit brokers offer up to $500,000 for WordPress RCE vulnerabilities. A security researcher demonstrates how AI assists in discovering these high-value zero-day exploits, revealing the lucrative underground market for security flaws.