Patchstack Blog
WordPress security news, vulnerability disclosures, and expert advice from the Patchstack team.
- Website
- patchstack.com · all feeds from this site
- Feed URL
https://patchstack.com/feed/
Read it in your FeedListing reader
Or add to: Feedly Inoreader Raw feed
Latest posts
-
WordPress doesn’t ship Brotli. It’s still exposed to CVE-2026-111497
One unauthenticated POST to xmlrpc.php can take down a PHP worker on a stock WordPress install, and there is nothing unusual about the request that does it. The attacker sends a pingback whose source URL points at a server they own. WordPress goes and fetches that URL, the…
-
WordPress 7.1.4 Security Release
WordPress 7.1.4 came out on 28 October 2026 with fixes for what WordPress counts as 22 vulnerabilities across 17 advisories. 7.1.3, three weeks ago, had seven. Almost everything here needs an account first, usually a Contributor. The exception is a race condition in the upgrade…
-
Major security alert: PHP vulnerable to critical RCE, attacks ongoing
PHP has released the fix. Update now. PHP has released security updates for two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and…
-
Stolen UpdraftCentral Keys Are Backdooring WordPress Sites
An attacker holding valid UpdraftCentral dashboard keys is installing backdoor plugins on connected WordPress sites. The campaign ran continuously through an 18-hour window on 18-19 October. Patchstack blocks UpdraftCentral remote commands and has deployed mitigation rules…
-
Critical Unauthenticated Arbitrary File Upload Vulnerability Exploited in Bricksforge Plugin
This blog post covers a Critical unauthenticated arbitrary file upload vulnerability in the Bricksforge plugin for WordPress. Patchstack has deployed a mitigation rule to protect against exploitation of this vulnerability. If you are a Bricksforge user, update to at least…
-
WordPress 7.1.3 Security Release
WordPress 7.1.3 landed on 6 October 2026. It’s a maintenance and security release with seven security fixes and four bug fixes. Two weeks ago, 7.1.2 fixed a single vulnerability (CVE-2026-87902) that allowed an unauthenticated visitor to trigger a local file inclusion and, under…
-
Four ways back in: the WordPress XSS campaign that hides its own admin account
Two unrelated WordPress plugins, two separate stored Cross-Site Scripting vulnerabilities, one payload. Over the past several days our telemetry has recorded exploitation attempts against both, and every attempt pulls the same JavaScript from imgcdn1.com. Two is what we have…
-
Cross-Site Request Forgery in Elementor Plugin Affecting 2 Million+ Sites
This blog post is about a Cross-Site Request Forgery vulnerability in the Elementor Website Builder plugin. One link, opened by a logged-in WordPress user, makes that user carry out any REST API action their account is permitted to perform. On a stock installation, an…
-
CVE-2026-87902: Attackers Started Probing WordPress Sites Hours After the Patch
Yesterday we wrote up CVE-2026-87902, the unauthenticated local file inclusion in WordPress page template resolution fixed in 7.1.2. That post covered the sink, the preconditions and the fix. This is the follow-up on what we are seeing hit our firewall. Update, 23 September…
-
WordPress 7.1.2 Security Release: Unauthenticated LFI to RCE
WordPress 7.1.2 landed on 22 September 2026. It’s a security-only release with a single fix, and that fix is the most serious thing WordPress has patched in a while: an unauthenticated local file inclusion in page template resolution that can reach remote code execution.…
-
Click2Shell: The RCE WordPress 7.1.1 Just Patched
WordPress 7.1.1 patched a vulnerability reported by pwn.ai’s Paulos Yibelo named Click2Shell, a complicated vulnerability chaining Cross-Site Request Forgery (CSRF) into selector injection to turn a single click into a remote shell. It was reported responsibly and was fixed in…
-
Patchstack Now Protects Your AI-Built Apps
WordPress isn’t the only place people build websites anymore. AI builders and Node.js hosting are now standard offerings from our own hosting partners, and that shift has quietly recreated every security problem we spent five years solving in WordPress, just with a different…
-
WordPress 7.1.1 Maintenance and Security Release
WordPress 7.1.1 landed on 17 September 2026. It’s a security and maintenance release with 11 security fixes and 17 Core bug fixes. The headline issue is an unauthenticated stored cross-site scripting (XSS) vulnerability in wpautop(), the function that turns line breaks into…
-
Launching managed CRA Article 14 reporting for open source maintainers
Starting on 11 September 2026, the first obligations under the European Cyber Resilience Act will kick in – more specifically, Article 14. This mostly affects companies that make products with digital elements available on the European market, but it also applies to open-source…
-
Unauthenticated PHP Object Injection to Remote Code Execution on GiveWP
This blog post is about an unauthenticated remote code execution vulnerability in the GiveWP plugin. An attacker with no account can run arbitrary commands on the server of a GiveWP site that has one published donation form and one active payment gateway which, on the versions…
-
Case study: ManageWP Blocks 11.9M+ Threats in 6 Months with Patchstack
Run one WordPress site and a vulnerability is a single bad day. Run an agency, and it’s a portfolio-wide panic event that results in lost sleep and enough caffeine to take down a horse. Updates can’t close that gap alone, especially when attackers weaponize the most-targeted…
-
One slug, seven editions: the miniOrange SAML SSO bug that let anyone log in as your WordPress admin
Reported by the DigitalOcean security team, with root cause analysis by DigitalOcean, coverage and vendor follow-up handled jointly with Patchstack. Most vulnerability write-ups are about the bug. This is primarily about everything around the bug, where the actual risk ended up…
-
Critical Unauthenticated File Upload to RCE in Elementor Pro Plugin
This blog post is about an unauthenticated arbitrary file upload vulnerability in the Elementor Pro plugin that leads to remote code execution. The flaw lives in the Forms module’s File Upload field, where the extension check and the file-move step run in two separate loops with…
-
FlyWP Adds Proactive Vulnerability Protection with Patchstack
We’re excited to announce that FlyWP has integrated Patchstack into their platform, bringing proactive WordPress vulnerability protection to their customers through a new security add-on: FlySecurity Pro. FlyWP offers managed WordPress cloud hosting and server management. From a…
-
When a PNG Isn’t a PNG: WordPress Patches an Author-Level Imagick RCE
The latest WordPress maintenance release 7.0.4 includes a quiet but important security fix, and it’s one worth understanding rather than just clicking “update” past. It changes how WordPress hands your uploaded media to ImageMagick, and it closes a path that could let a…