On October 23, 2020, our Threat Intelligence team responsibly disclosed several vulnerabilities in Ultimate Member, a WordPress plugin installed on over 100,000 sites. These flaws made it possible for attackers to escalate their privileges to those of an administrator and take over a WordPress site. We initially reached out to the plugin’s developer on October …
Read Later Add to Favourites Ultimate Member vulnerabilities
On May 5, Patchstack published a security advisory about a high severity reflected cross-site scripting (XSS) vulnerability in ACF (Advanced Custom Fields), potentially affecting more than 4.5 mill…
WordPress SSRF Attack In 2021, Microsoft released a security advisory warning of a critical SSRF vulnerability in their Exchange Server software, which was being actively exploited in the wild by[…]
If you’re a Advanced Custom Fields free and pro user, please update the plugin to at least version 6.1.6.Patchstack Pro and Business users are protected from the vulnerability.
Attackers are always finding new and creative ways to compromise websites and maintain their foothold in environments. This is frequently done via the use of backdoors: PHP scripts designed to[…]
How WP Engine automates security for over 1.5 million customer sites with WPScan. The Hero: WP Engine The Problem “We know that there are other options out there, but given[…]
WordPress powers over 43% of the web, and that makes it a prime target for hackers and bots. But […]