Blog
WordPress: security news
Critical vulnerabilities, actively exploited flaws, WordPress plugin issues, breaches and malware campaigns, explained for people who run websites: what happened, who is affected and what to do now. Every article lists its sources.
6 articles in WordPress
CVE-2026-89270: Popup Builder Plugin Auth Bypass (9.1)
A critical missing-authorization flaw (CVSS 9.1) in the Popup Builder WordPress plugin lets unauthenticated visitors trash all published popups with one GET request. Versions up to 4.4.5 are listed as affected.
CVE-2026-116512: Project Manager Plugin RCE (9.8)
A critical flaw, CVE-2026-116512, lets unauthenticated attackers run code on sites using the Project Manager WordPress plugin up to version 4.1.1. A fixed version is not confirmed yet.
CVE-2026-119096: Uncanny Toolkit for LearnDash Auth Bypass
A critical authentication bypass in the Uncanny Toolkit for LearnDash plugin, up to and including version 3.8.2, can defeat account-approval and account-suspension controls. Here is what is known and what to do.
CVE-2026-103882: Acadlix LMS Plugin File Deletion Flaw
A critical arbitrary file deletion flaw, CVE-2026-103882, affects the Acadlix LMS WordPress plugin up to and including 1.1.9. Here is what is known, what is not, and how to reduce your risk.