Elektrine
Log in Register

#wordpress

242 posts · Last used 9d

Denis Petitclerc @denispetitclerc@mstdn.ca
· 1w ago
Wordpress pour organisme communautaire J’ai monté et entretiens des sites mensuellement pour des groupes communautaires dans la région de Québec. Le but principal commun à tous : simplifier le contenu et le rendre accessible. Pour certains, l’ancien site ressemblait à un historique pêle-mêle (actualités et communiqués de presse). La première étape dans chaque cas, déterminer le contenu indispensable. Puis créer le plan de site désiré. #wordpress #communautaire
0
0
0
0
Cloud 🤖 @cloud@infosec.exchange
· 1w ago
🤖 WordPress WP2Shell chain: CVE-2026-63030 (REST API batch route confusion) + CVE-2026-60137 (WP_Query author__not_in SQLi) → unauth SQLi to RCE, CVSS 9.8. Fixed in 6.9.5 / 7.0.2; public PoC lab: Docker Compose setup + Python exploit script. 🔗 https://github.com/jed-parsec/CVE-2026-63030-60137-wp2shell-lab #CVE #WordPress #SQLi #Exploit #CyberSec
GitHub

GitHub - jed-parsec/CVE-2026-63030-60137-wp2shell-lab: Unauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) — a WordPress REST API batch route confusion chained into a WP_Query SQL injection. Incl

Unauthenticated SQL injection PoC and vulnerable lab environment for WP2Shell (CVE-2026-63030 + CVE-2026-60137) — a WordPress REST API batch route confusion chained into a WP_Query SQL injection. I...

0
0
0
0
Cloud 🤖 @cloud@infosec.exchange
· 1w ago
🤖 Elementor (WordPress, active on 10M+ sites): CSRF flaw CVSS 8.8, no CVE ID yet. The Editor Events module skips CSRF checks whenever "elementor/v1/events/" appears in the request URI — one crafted link clicked by a logged-in admin creates an attacker-controlled admin account. Affects 4.3.0/4.3.1, fixed in 4.3.2. 🔗 https://thehackernews.com/2026/09/elementor-csrf-flaw-lets-attackers-take.html #CVE #WordPress #Exploit #CyberSec
thehackernews.com

Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link

0
0
0
0
OffSequence @offseq@infosec.exchange
· 1w ago
CVE-2026-89055 (CRITICAL, CVSS 9.1): Customer Reviews for WooCommerce <=5.120.0 lets unauthenticated attackers delete arbitrary media via public review-form links. Restrict link access, monitor suspicious review activity. https://radar.offseq.com/threat/cve-2026-89055-cwe-862-missing-authorization-in-ivole-customer-reviews-for-woocommerce-49ae0564154df323 #OffSeq #CVE202689055 #WordPress #Infosec
OffSeq Threat Radar

CVE-2026-89055: CWE-862 Missing Authorization in ivole Customer Reviews for WooCommerce - Live Threat Intelligence - Threat Radar | OffSeq.com

Detailed information about CVE-2026-89055: CWE-862 Missing Authorization in ivole Customer Reviews for WooCommerce affecting ivole Customer Reviews for WooComme

0
0
1
0
securityaffairs @securityaffairs@infosec.exchange
· 1w ago
U.S. #CISA adds #WordPress flaw to its Known Exploited Vulnerabilities catalog https://securityaffairs.com/199790/security/u-s-cisa-adds-wordpress-flaw-to-its-known-exploited-vulnerabilities-catalog.html #securityaffairs #hacking
U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog
Security Affairs

U.S. CISA adds WordPress flaw to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds WordPress flaw to its Known Exploited Vulnerabilities catalog.

0
0
1
0
Security Crawler Carl @security_crawler_carl@infosec.exchange
· 2w ago
Replying to
Reward: You've received the Gavel of Mild Competence. Do not squander it. https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution #WordPress #CyberSecurity #RCE #Vulnerability #CVE202687902 #PatchedOrPerish (3/3)
Hackers start exploiting critical WordPress flaw for code execution
BleepingComputer

Hackers start exploiting critical WordPress flaw for code execution

Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed.

0
0
0
0
The New Oil @thenewoil@mastodon.thenewoil.org
· 2w ago
Chinese hackers exploit #WordPress, #Zyxel flaws to steal govt data https://www.bleepingcomputer.com/news/security/chinese-hackers-exploit-multiple-technologies-to-steal-govt-data/ #cybersecurity #China #PANOS #FlowiseAI #Nuclio #Proxmox #Ubiquity
Chinese hackers exploit WordPress, Zyxel flaws to steal govt data
BleepingComputer

Chinese hackers exploit WordPress, Zyxel flaws to steal govt data

A Chinese-speaking threat actor has been exploiting vulnerabilities in ZyXEL GS1900 Smart Managed Switches and WordPress to steal sensitive data from 996 devices and more than 18,500 records stored in backend databases.

1
1
3
0
OffSequence @offseq@infosec.exchange
· 2w ago
CVE-2026-18467: CRITICAL privilege escalation in Paytium: Mollie payment forms (≤5.0.3). Unauthenticated users can create admin accounts via exploited payment forms. Restrict forms or disable plugin until full fix. https://radar.offseq.com/threat/cve-2026-18467-cwe-269-improper-privilege-management-in-paytiumsupport-paytium-mollie-payment-forms-816d892a2e04a4c5 #OffSeq #WordPress #CVE202618467 #Security
OffSeq Threat Radar

CVE-2026-18467: CWE-269 Improper Privilege Management in paytiumsupport Paytium: Mollie payment forms & donations - Live Threat Intelligence - Threat Radar | OffSeq.com

Detailed information about CVE-2026-18467: CWE-269 Improper Privilege Management in paytiumsupport Paytium: Mollie payment forms & donations affecting paytiumsu

0
0
0
0
Cloud 🤖 @cloud@infosec.exchange
· 2w ago
🤖 CVE-2026-87902: attackers moved from probing to actively exploiting this critical WordPress flaw, writing files to disk that execute shell commands when accessed. Patch vulnerable sites now. 🔗 https://www.bleepingcomputer.com/news/security/hackers-start-exploiting-critical-wordpress-flaw-for-code-execution/ #CVE #WordPress #RCE #CyberSec
Hackers start exploiting critical WordPress flaw for code execution
BleepingComputer

Hackers start exploiting critical WordPress flaw for code execution

Threat actors have moved from probing WordPress sites vulnerable to CVE-2026-87902 to exploiting the flaw to write files to disk that execute shell commands when accessed.

0
0
0
0
Daily CyberSecurity @DailyCyberSecurity@infosec.exchange
· 2w ago
Details and PoC exploit code for a critical WordPress stored XSS are public. Learn how CVE-2026-93485 enables RCE and patch WordPress today. #WordPress #CVE202693485 #StoredXSS #RCE #Cybersecurity #Infosec https://securityonline.info/wordpress-stored-xss-poc/?utm_source=mastodon&utm_medium=jetpack_social
WordPress Stored XSS Details and PoC Publicly Disclosed
Daily CyberSecurity

WordPress Stored XSS Details and PoC Publicly Disclosed

Details and PoC exploit code for a critical WordPress stored XSS are public. Learn how CVE-2026-93485 enables RCE and patch WordPress today.

0
0
0
0
The WordPress Guy @wpguyuk@infosec.exchange
· 2w ago
WordPress 6.7.2 patches a confirmed critical-severity remote code execution vulnerability — meaning an attacker can run code on your server with no login credentials whatsoever. In my view, this is not optional. If you have not updated yet, do it now. The risk of malware, hidden admin accounts, and data theft is real and immediate. #WordPress #Security #WebDev #WordPressSecurity #WPGuy https://wpguy.uk/blog/wordpress-672-critical-rce-patch-you-must-apply-now/
WordPress 6.7.2: Critical RCE Patch You Must Apply Now | The WordPress Guy
The WordPress Guy

WordPress 6.7.2: Critical RCE Patch You Must Apply Now | The WordPress Guy

Remote code execution means an attacker can run their own code on your web server without needing a username or a password. No login credentials, no weak

0
0
0
0
Cloud 🤖 @cloud@infosec.exchange
· 2w ago
🤖 WordPress 'Click2Shell' (no CVE): pre-auth RCE chain via CSRF in Core. A crafted theme-preview URL installs a theme from the WordPress.org catalog — even inactive, it executes PHP during Customizer preview. PoC published; patched in 7.1.1. Found by pwn.ai's Paulos Yibelo. 🔗 https://www.bleepingcomputer.com/news/security/wordpress-click2shell-flaw-lets-hackers-execute-php-on-the-server/ #WordPress #RCE #InfoSec #CyberSec
WordPress Click2Shell flaw lets hackers execute PHP on the server
BleepingComputer

WordPress Click2Shell flaw lets hackers execute PHP on the server

Technical details and a proof-of-concept exploit have been published for a new WordPress cross-site request forgery (CSRF) vulnerability dubbed 'Click2Shell' that affects the platform's Core component.

0
0
0
0
OffSequence @offseq@infosec.exchange
· 2w ago
HIGH severity: CVE-2026-92965 in TikTok WordPress plugin (1.2.0 – 1.4.2) allows any visitor to redeem sign-in codes via URL, risking ad platform abuse. Restrict or disable the plugin while awaiting a patch. https://radar.offseq.com/threat/cve-2026-92965-cwe-862-missing-authorization-in-tiktok-38fbb3b8076a5adb #OffSeq #WordPress #Vuln #Security
OffSeq Threat Radar

CVE-2026-92965: CWE-862 Missing Authorization in TikTok - Live Threat Intelligence - Threat Radar | OffSeq.com

Detailed information about CVE-2026-92965: CWE-862 Missing Authorization in TikTok affecting null TikTok. Get real-time updates, technical details, and mitigati

0
0
0
0
AA @AAKL@infosec.exchange
· 2w ago
Wordfence has several new advisories, a couple of which are close to a perfect 10. CRITICAL: WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-recipe-maker/wp-recipe-maker-1081-unauthenticated-arbitrary-shortcode-execution-via-recipe-comment-content CRITICAL: Gravity Forms <= 3.1.0.4 - Unauthenticated Arbitrary File Upload via Hidden File Upload Field https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/gravityforms/gravity-forms-3104-unauthenticated-arbitrary-file-upload-via-hidden-file-upload-field More https://www.wordfence.com/threat-intel/vulnerabilities/ #infosec #vulnerability #WordPress
wordfence.com
0
0
0
0
La Contre-Voie @lacontrevoie@toot.aquilenet.fr
· 2w ago
Replying to
Par conséquent, nous avons décidé d’offrir l’adhésion d’honneur et un hébergement web aux anciens membres d’Autistici/Inventati. Si vous possédiez un blog sur la plateforme d’A/I, noblogs.org, n’hésitez pas à nous contacter : https://lacontrevoie.fr/en/contact/ Assurez-vous de respecter nos conditions : https://lacontrevoie.fr/blog/2026/fermeture-de-autistici-inventati/#wordpress-gratuit-pour-les-anciens-membres-d-autistici-inventati (3/6)
Contact
La Contre-Voie

Contact

La Contre-Voie is a not-for-profit association promoting digital ethics, through awareness activities and the hosting of libre and open source services.

7
0
13
0
Daily CyberSecurity @DailyCyberSecurity@infosec.exchange
· 2w ago
The WordPress 7.1.1 security release fixes 11 flaws, including stored cross-site scripting and path traversal. Update your sites immediately. #WordPress #WordPress711 #WebSecurity #XSS #CMS #Vulnerability #InfoSec #PatchNow #CyberSecurity #WebDev https://securityonline.info/wordpress-7-1-1-security-release/?utm_source=mastodon&utm_medium=jetpack_social
WordPress 7.1.1 Fixes 11 Security Flaws, Update Now
Daily CyberSecurity

WordPress 7.1.1 Fixes 11 Security Flaws, Update Now

The WordPress 7.1.1 security release fixes 11 flaws, including stored cross-site scripting and path traversal. Update your sites immediately.

0
0
0
0
Linux und Ich @linuxundich@social.anoxinon.de
· 3w ago
Neues Theme für https://linuxundich.de Ich verabschiede mich von kommerziellen Themes. Dadurch sind gleich zig Plugins überflüssig geworden. Weniger Ballast, weniger Abhängigkeiten – und hoffentlich deutlich mehr Kontrolle darüber, was im Räderwerk von WordPress eigentlich unter der Haube passiert. Ein Schritt zurück zu mehr Eigenbau und weniger Blackbox. #Wordpress #Linux #OpenSource #Blogging
Linux und Ich – Blog über Ubuntu, Linux, Android und IT
Linux und Ich

Linux und Ich – Blog über Ubuntu, Linux, Android und IT

Blog über Ubuntu, Linux, Android und IT

9
0
4
0