#phpwordpress

‼️ CISA Warns of WordPress Core Vulnerability Exploited in Attacks to Execute Malicious Code Details: CISA has warned that attackers are exploiting a WordPress Core vulnerability that can allow malicious code to run on website servers. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 3, 2026, confirming evidence of active exploitation and raising the need for prompt patching. Tracked as CVE-2026-119977, the vulnerability affects WordPress Core versions 4.7 through 7.1.3 and carries a high severity CVSS score of 8.1. Attackers do not need a valid account or user interaction. However, exploitation requires precise timing during a full WordPress Core upgrade, rather than simply visiting any website running an affected version. #cybersecurityNews

🚨 Attackers are targeting an unpatched CVSS 10.0 flaw in the CryptoPayment Gateway WordPress plugin. CVE-2026-81648 can let unauthenticated attackers extract wallet credentials, delete server files, and overwrite payment settings. No known fix. Exploitation attempts observed in the wild. Full details ↓

Looking to connect with skilled WordPress developers for upcoming website projects. Budget 10k USD. Drop your portfolio in my DMs.

🚨 WordPress Core flaw under active exploitation. CISA confirms attacks targeting CVE-2026-119977, a high-severity race condition that can allow unauthenticated code execution during core upgrades. Over 12,600 exploit attempts blocked in 24 hours. Details:

WordPress 7.2 Beta 4 is available for testing. Check accessibility, editor reliability, and developer API updates in a local or test environment, not on a production site.

WordPress 7.1.4 is now available. This security release fixes multiple issues, and site owners should update immediately. Update from the WordPress Dashboard or download the release.

🛡️We added WordPress remote code execution vulnerability CVE-2026-119977 to our KEV Catalog. Visit & apply mitigations to protect your org. #Cybersecurity #InfoSec

‼️ Over 60,000 Attacks Target WordPress RCE Vulnerability Within 24 Hours Details: Hackers are targeting a WordPress Core remote code execution vulnerability that can expose websites during software updates. The supplied Wordfence threat intelligence snapshot lists 60,471 blocked attempts over 24 hours. WordPress released version 7.1.4 on October 28, 2026, addressing 22 security vulnerabilities. The update closes the code execution weakness alongside stored cross-site scripting, information disclosure, and permission issues. These are attack attempts, not confirmed website compromises, and the figure does not establish how many individual sites were targeted. #CybersecurityNews

CISA flags WordPress RCE flaw as actively exploited in attacks

Over 40% of modern websites are built on top of Content Management Systems like WordPress 🌐🔍 because outdated themes and forgotten plugins are a massive attack surface, security professionals use specialized tools like WPScan to run deep component audits instantly 🛡 Safe Local Sandbox [ 127.0.0.1:8080 ] #WPScan #WebSecurity #AppSec #InfoSecTips

The AI plugin 1.5.0 is now available. New experiments let you generate audio for a post, see what changed between revisions, and check uploaded images for C2PA Content Credentials. The release also includes security fixes, so update when you can.

🚨 Nearly 63,000 attack attempts target a WordPress RCE flaw in just 24 hours. Attackers are repeatedly probing upgrade paths, trying to catch a brief window during core updates that could allow unauthenticated code execution. Details ↓

We know it’s a busy season for a lot of website owners. Through November, sites on free plans can connect to @ChatGPT and build and manage their @WordPress site right from the chat. Pick something off the to-do list and get it done. ✅

I found & reported a #WordPress core pre-auth RCE (triggered during the update process) with @xint_official . I submitted it as a 0-day, but WordPress released a patch almost as soon as the reporting platform confirmed the vulnerability was valid. Missed the credit, but huge shoutout to Umut Bayram for reporting first! 🙌 Plot twist: updating to the fix can expose RCE. Here's why + safe update guide:

WordCamp Asia 2027 wants to know who you would like to hear from. The Invited Speakers Program is taking recommendations for people and topics, from building for the open web to growing a career to contributing to open source. You can send your ideas until November 8, 2026.

This week on @xCloud_host we shipped for people who manage 40 sites, not 1. → Security Center: every vulnerable plugin, old PHP version and waiting patch on one page, each with one button to fix it → One To-Do list across all your servers and sites → Backups you can protect from auto delete Agencies, what should we build next? #WordPress #WebHosting

i built a desktop app that runs all your WordPress sites from one place it's free, open source, and nothing goes through our servers i ran an agency for years and never wanted to pay per site for something i could log in and do myself → shows which sites are down before your client tells you → flags which pending updates are security fixes, so you run those first → runs core, plugin and theme updates across every site in one pass → one click into any wp-admin, no passwords to dig up → every change is logged, and many come with an undo → no site cap, no per-site price, no dashboard server to host macOS, Windows and Linux launching very soon. comment "wp" and i'll send it to you first

🚨 HIRING: WORDPRESS WEB DEVELOPER Earn up to $3,800/month working remotely from Nigeria! 📍 Location: Remote (Nigeria) 💰 Salary: $2,900–$3,800/month 💼 Type: Full-time 🗓️ Schedule: Monday–Thursday (4-day workweek) 📌 Experience: 2–5 years Interested? Comment below 👇

PHP2Shell Update: Still No Confirmed WordPress Compromises - Here's what we've seen from protecting over 5 million WordPress sites: As of October 28, 2026, Wordfence is not aware of any WordPress site compromises through PHP2Shell (CVE-2026-109618 and CVE-2026-109619). We continue to see PHP2Shell-related requests across the more than 5 million sites we protect. Those requests show ongoing scanning and exploitation attempts; they do not show whether an attempt succeeded. Our site-cleaning and incident response teams have not handled a WordPress compromise attributed to these vulnerabilities. That does not make an unpatched server safe. The fix is still to update PHP on your server to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (or a vendor package confirmed to contain both fixes) and restart PHP. Updating WordPress does not update PHP. Read more in the full post here:

a new WordPress Studio a modern WordPress workspace for a modern WordPress workflow. ✓ all new workspace ✓ agent + live preview ✓ bring your own agent (more soon!) ✓ pinned sites & chats ✓ annotations ✓ customize the ui to taste ✓ sharing & publishing ✓ mcp for claude / codex / cursor ✓ DESIGN.md ✓ command palette ✓ WordPress skills & commands ✓ mac, windows, linux (free download, open source)