Vulnerabilities
Wordfence Argus Finds Critical Ghostscript Flaw Allowing Remote Code Execution
A heap buffer overflow in Ghostscript allows attackers to execute code remotely via crafted PDFs, according to new research from Wordfence.
WordPress
Everything Threat Times has reported about WordPress: 39 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Attackers Actively Exploit Critical Bricksforge WordPress Plugin Flaw for Remote Code Execution
Patchstack reports active wild exploitation of CVE-2026-85097, a maximum-severity flaw in Bricksforge allowing unauthenticated remote code execution on WordPress sites.
AI
CyberXero Uses AI to Steal 628,000 Ukrainian Records in Campaign
Researchers attribute an AI-augmented intrusion campaign targeting Ukrainian infrastructure and global WordPress sites to the broker group CyberXero.
Vulnerabilities
Wordfence Releases Weekly WordPress Vulnerability Report for Late September 2026
Wordfence Intelligence published its weekly vulnerability digest covering disclosures from September 28 through October 4, 2026, for WordPress administrators.
Vulnerabilities
Unauthenticated RCE Vulnerability Found in SiteVault WordPress Plugin Versions Up to 1.5.19
The National Vulnerability Database lists a critical flaw in Royal Plugins SiteVault that allows attackers to execute code without authentication.
Vulnerabilities
Critical PHP Object Injection Flaw Found in Dynamic User Directory Plugin
A CVSS 9.8 vulnerability in the Dynamic User Directory plugin allows remote attackers to inject PHP objects in versions up to 2.4.
Vulnerabilities
Unauthenticated PHP Object Injection Flaw Found in CleanSkin Plugin
A critical vulnerability in the CleanSkin WordPress plugin allows attackers to inject malicious code without logging in.
Vulnerabilities
Tonda Membership Plugin Has Critical Unauthenticated Privilege Escalation Flaw
The National Vulnerability Database rates CVE-2026-62022 as critical due to an unauthenticated privilege escalation issue in versions up to 1.0.1.
Vulnerabilities
DirectoryPress Plugin Vulnerable to Critical Unauthenticated File Inclusion
A critical flaw in DirectoryPress versions up to 3.6.27 allows unauthenticated local file inclusion, rated CVSS 9.8 by the NVD.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Found in Stargaze WordPress Theme
The National Vulnerability Database lists CVE-2026-62051 as a critical flaw in Stargaze versions up to 1.10, allowing remote code execution.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Found in Splendour WordPress Theme
The National Vulnerability Database lists CVE-2026-62050 as a critical flaw allowing remote code execution in Splendour versions up to 1.23.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Flaw Found in Tipsy Theme
The National Vulnerability Database rates CVE-2026-62052 as critical for Tipsy versions 1.6 and earlier due to unauthenticated injection risks.
Vulnerabilities
Critical PHP Object Injection Flaw Found in Wine House WordPress Theme
Unauthenticated attackers can exploit CVE-2026-62053 in Wine House versions up to 3.20 to achieve critical remote code execution.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Found in Yacht Rental WordPress Theme
The National Vulnerability Database lists CVE-2026-62054 as a critical flaw allowing remote code execution in Yacht Rental versions up to 2.6.
Vulnerabilities
Critical Unauthenticated PHP Object Injection Found in Juno WordPress Theme
A severe vulnerability in the Juno WordPress theme allows attackers to execute code without authentication, affecting versions up to 2.25.
Vulnerabilities
Equadio WordPress Theme Faces Critical Unauthenticated PHP Object Injection Flaw
The National Vulnerability Database rates CVE-2026-62087 as critical, affecting Equadio versions up to 1.1.4 with a CVSS score of 9.8.
Vulnerabilities
Critical Path Traversal Flaw in rtMedia Plugin Exposes WordPress Sites to Data Breach
The National Vulnerability Database rates CVE-2026-105892 as critical, highlighting a severe security risk for users of the rtMedia plugin for WordPress and BuddyPress.
Vulnerabilities
WPCOM Member Plugin Critical Auth Bypass Lets Attackers Hijack Admin Accounts
A critical authentication bypass in the WPCOM Member WordPress plugin allows unauthenticated attackers to log in as any user, including administrators, through session forgery.
Vulnerabilities
Critical Deserialization Flaw Found in Travesia WordPress Theme Through Version 1.1.16
The National Vulnerability Database lists a CVSS 9.8 critical object injection vulnerability in ThemeREX Group Travesia, affecting versions up to 1.1.16.
Vulnerabilities
Critical Deserialization Flaw Found in ThemeREX Rosalinda WordPress Theme
A CVSS 9.8 vulnerability in the Rosalinda theme allows object injection, affecting versions up to 1.2.4 according to the National Vulnerability Database.
Vulnerabilities
ThemeREX Smash Plugin Faces Critical Deserialization Flaw in Versions Up to 1.12.0
The National Vulnerability Database lists CVE-2026-93931 as critical, exposing users of older Smash plugin versions to remote object injection risks.
Vulnerabilities
Critical Deserialization Flaw in ThemeREX IPharm Plugin Rated 9.8
A severe object injection vulnerability in the IPharm WordPress plugin affects versions up to 1.2.4, allowing attackers to execute arbitrary code on affected sites.
Vulnerabilities
Let's Play Plugin Critical Flaw CVE-2026-93935 Allows Object Injection
The National Vulnerability Database rates a deserialization flaw in ThemeREX Group's Let's Play plugin as critical, affecting versions through 1.1.15.
Vulnerabilities
Critical Object Injection Flaw Found in ThemeREX Partiso Theme
A CVSS 9.8 vulnerability in Partiso versions up to 1.1.13 allows untrusted data deserialization and object injection, posing a severe risk to affected sites.