Patching would not have helped. The sites were current. The exposure was a remote-management channel an administrator switched on, running at that administrator's permission level.
Read Article →Your association added a second language years ago and a translation plugin has been running quietly ever since. Here is how one ends up keeping a copy of a password...
Read Article →Your site has user registration turned off, so a registration-related flaw sounds like somebody else's problem. With GiveWP it is not. Here is the flaw in plain language and what...
Read Article →Your scholarship application asks for a transcript and your conference form asks for a CV. Both let a stranger put a file on your server. Here is a twenty-minute triage...
Read Article →Forminator shipped four security releases in about four weeks, the last of them CVE-2026-18325, a stored cross-site scripting flaw Wordfence rated 7.2. The coverage has the classification wrong, and the...
Read Article →A stranger leaves a trackback in September. Nothing happens until your agency exports the site for a redesign in February. Here is the chain, what is actually known about exploitation,...
Read Article →Three advisories before lunch and nothing on your site has changed. On September 11 the EU reporting clock starts for your commercial vendors, and not for your free plugins. Here...
Read Article →A high-severity Gravity Forms vulnerability was patched on August 20. Free Wordfence users do not receive the firewall rule until September 12. Here is what that gap actually means and...
Read Article →Attackers poisoned a promotional data feed the plugins were built to request, so no plugin file changed and no update could have stopped it. Per Wordfence, rogue administrator accounts and...
Read Article →WordPress 7.0 did not add a chatbot to the block editor. It built the plumbing that makes every future AI feature in the ecosystem more manageable, more secure, and more...
Read Article →