As they happen
WordPress security incidents
Plugin and vendor security incidents, written up as they happen.
Supply chainMalicious release shippedCVSS 9.8CVE-2026-111862
Rank Math PRO 3.0.123 shipped malware through its own updates
For about 11 hours on October 15–16, some Rank Math PRO 3.0.123 downloads and auto-updates carried malware. Updating to 3.0.124 does not clean an infected site.
File upload to code executionActively exploitedCVSS 10CVE-2026-85097
Bricksforge flaw lets anyone run code on the server, no login needed
A maximum-severity flaw in Bricksforge, an add-on for the Bricks builder, let attackers upload and run PHP without an account. Attacks began the day before the public advisory.
File inclusionActively exploitedCVSS 9.2CVE-2026-87902
WordPress core flaw exploited the same day it was patched
A flaw in how WordPress core resolves page templates could let attackers run code without logging in. Patches shipped September 22, and attacks started within hours. CISA added it to its exploited-vulnerabilities list.
SQL injectionProof of concept publicCVSS 8.8CVE-2026-19949
All-in-One WP Migration: a restore could hand over the site
A hidden SQL injection in All-in-One WP Migration and Backup (5M+ installs) let attackers plant data that fired during the next export or restore, leaking the key needed to take over the site.
File upload to code executionActively exploitedCVSS 9CVE-2026-32475
Elementor Pro form uploads let attackers drop a web shell
A file upload flaw in Elementor Pro's Forms widget let attackers write a PHP file to the server without logging in. It was patched August 19, and mass attacks followed in September.
BackdoorMalicious release shippedCVSS 9.8CVE-2026-18072
Advanced Responsive Video Embedder release carried a login backdoor
A malicious release of the ARVE video plugin (10.8.7) let anyone with a secret token log in as an admin. It's believed the attacker got in through the developer's account. WordPress.org pulled the plugin.