News Security CVE-2026-19513: Gravity Forms unauthenticated file upload risk and what site owners should do September 2, 2026 by Alex Mira | Leave a Comment CVE-2026-19513 affects Gravity Forms ≤ 3.0.2, allowing unauthenticated file writes under specific conditions. Update to 3.0.3+ and verify upload directory behavior, especially on NGINX. Read more » Arbitrary file upload CVE-2026-19513 Gravity Forms NGINX Plugin vulnerability Remote code execution risk WordPress security
News Security Avada zero-click RCE chain (CVE-2026-18431) and a separate Fusion Builder XSS: what WordPress admins should know August 31, 2026 by Alex Mira | Leave a Comment A critical six-step chain in the Avada theme enables zero-click RCE (CVE-2026-18431), and a separate stored XSS impacts Fusion Builder up to 3.15.6 (CVE-2026-16654). Here’s what’s confirmed and what to update now. Read more » Avada theme CVE-2026-16654 CVE-2026-18431 Fusion Builder Remote code execution Stored XSS WordPress security
News Security CVE-2026-32475: Critical Elementor Pro file upload flaw can enable unauthenticated RCE August 21, 2026 by Alex Mira | Leave a Comment Elementor Pro sites with a File Upload field in a public form are exposed to a critical file upload flaw (CVE-2026-32475) that can enable unauthenticated RCE. Update to 4.2.2+ and audit the Elementor forms upload directory. Read more » CVE-2026-32475 Elementor Pro Patch management Plugin Vulnerabilities Remote code execution WordPress security
News Security Critical authentication bypass reported in User Profile Builder plugin August 18, 2026 by Alex Mira | Leave a Comment Wordfence reports a critical authentication bypass in the User Profile Builder plugin (CVE-2026-15826) that can log attackers in as user ID 1 under specific settings. Update to version 3.16.5 and review autologin configuration. Read more » Authentication bypass CVE-2026-15826 Plugin vulnerability User Profile Builder Website security Wordfence WordPress security
News Security CVE-2026-18072: Backdoored ARVE plugin enables admin logins without credentials July 29, 2026 / July 29, 2026 by Alex Mira | Leave a Comment CVE-2026-18072 affects Advanced Responsive Video Embedder (ARVE) 10.8.7, where a hardcoded backdoor can grant admin access without credentials. Check your version and remove 10.8.7 immediately if present. Read more » ARVE plugin Authentication bypass CVE-2026-18072 incident response plugin supply chain WordPress security
News Security ShapedPlugin supply-chain compromise: backdoored Pro updates via official channels (CVE-2026-10735) June 22, 2026 / June 22, 2026 by Alex Mira | Leave a Comment Wordfence and BleepingComputer report a ShapedPlugin supply‑chain compromise that backdoored Pro updates via official channels (CVE-2026-10735). Free repo builds were reported clean. Read more » 2FA CVE-2026-10735 incident response ShapedPlugin Supply chain attack WooCommerce WordPress security
News Security Active exploits hit Gravity SMTP (CVE-2026-4020); Avada Builder critical bug patched (CVE-2026-8713) June 22, 2026 / June 22, 2026 by Alex Mira | Leave a Comment Active exploitation hits Gravity SMTP (CVE-2026-4020) while Avada Builder’s critical file deletion bug (CVE-2026-8713) is patched. Update now, check logs for the Gravity SMTP REST endpoint, and consult Wordfence’s indicators for targeted IPs. Read more » Avada Builder CVE-2026-4020 CVE-2026-8713 Gravity SMTP incident response Plugin vulnerability WordPress security
News Critical auth bypass in Burst Statistics plugin puts 200,000 WordPress sites at risk June 2, 2026 / June 2, 2026 by Alex Mira | Leave a Comment A critical auth bypass in the Burst Statistics WordPress plugin (CVE-2026-8181) could let attackers impersonate admins via the REST API. A patch is available; update now. A separate low-severity bypass in Advanced Access Manager (CVE-2026-42674) is fixed in 7.1.1. Read more » Advanced Access Manager Authentication bypass Burst Statistics CVE-2026-8181 Patch management Vulnerabilities WordPress security
News CVE-2026-8732: WP Maps Pro flaw enables unauthenticated admin account creation June 2, 2026 / June 2, 2026 by Alex Mira | Leave a Comment CVE-2026-8732 in WP Maps Pro allows unauthenticated creation of administrator accounts on WordPress sites. Update to the patched release and verify there are no unexpected admin users. Read more » CVE-2026-8732 Plugin vulnerability Privilege escalation Site takeover Wordfence WordPress security WP Maps Pro
