Discovering attachmentAV: Real-Time Malware Scanning for Every File Your WordPress Site Accepts
attachmentAV scans WordPress form and Media Library uploads for malware with Sophos, blocking infected files[…]
Security
Latest posts
- in Security
Hackers Exploit WooCommerce Plugin Bug to Take Over WordPress Sites Without Login
Hackers exploit a critical WooCommerce flaw to upload executable code and hijack WordPress sites without[…]
- in Security
Inside a Malicious, Stealthy WordPress Must Use Plugin
The Wordfence Threat Intelligence Team identified an interesting malware sample in mid June during a[…]
WordPress Plugin Security Best Practices: What a WordPress.org Review Taught Us
On August 6, 2026, six of our plugins were closed by the WordPress.org Plugin Directory[…]
- in Security
Grok Bot found malware on WP.org during a routine check
Within Grok Bot I have a bot dedicated for WP Beacon. After two weeks of[…]
Rank Math WordPress Plugin Accused Of Secretly Taking Admin Access
WordPress users upset at Rank Math over allegations that it creates administrator-level access without prior[…]
- in Security
WPForms Lite Faces Backdoor Allegation As Questions Emerge In The Community
Sybre Waaijer has alleged that Awesome Motive introduced a backdoor in WPForms Lite version 2.0.0,[…]
Wordfence PRISM Detected Backdoored WordPress Plugin within Two Hours of it Being Introduced
On July 28th, 2026, our autonomous AI vulnerability intelligence agent, Wordfence PRISM, identified a critical[…]
- in Security
Security incident on 31 July 2026: What Happened and What You Should Do
Fluent Forms Pro 6.2.7 and Ninja Tables Pro 5.2.11 were tampered with. Update to versions[…]
- in Security
Protect The Shire solves one problem, but risks making another worse
What WordPress.org’s 24-hour update delay (Protect the Shire) actually cost the ecosystem, and why 6[…]
Under the Hood of WP Cerber 9.9
This release is mostly about the parts of WP Cerber you never notice until something[…]
Hardening GitHub Actions workflows across the WordPress organisation
In recent months several supply chain attacks have successfully exploited weaknesses in GitHub Actions workflow[…]
- in Security
Ninety minutes: watching attackers weaponize the WordPress core RCE
When we published our advisory on July 17, we ended it with the usual line:[…]
SandyWP is awesome. And I exploited it.
The owner of SandyWP asked me to look for bugs. I went in blind, drove[…]
Cloudflare WAF protects WordPress applications from two high-severity vulnerabilities
Cloudflare has deployed new Web Application Firewall (WAF) protections for two critical vulnerabilities affecting WordPress.[…]
Anatomy of a WordPress.org supply-chain attack: the six ways in
Six ways an attacker turns a trusted WordPress.org plugin into a foothold on your site,[…]
- in Security
Awesome Motive Breach Widens as Uncanny Automator Confirms Customer Data Theft, MonsterInsights Users Hit With Phishing Campaign
A critical vulnerability in UpdraftPlus that was disclosed on June 10 has now been linked[…]
Developer Traces 13-Year Backdoor Campaign Across 44 WordPress.org Plugins to a Single Operator
Anchor Hosting founder Austin Ginder has traced a 13-year supply chain operation back to a[…]
- in Security
Security Incident Notice: Uncanny Automator
We are writing to inform you of a security incident affecting Uncanny Automator and automatorplugin.com.[…]
- in Security
The Hacker Mindset: Inside the World of Bug Bounties and WordPress Security with Francesco Carlucci
Francesco Carlucci joins The Melapress Show to discuss bug bounties, WordPress vulnerabilities, hacker mindset, XSS,[…]
