WebsiteAdmin Blog

News

21 Sep 2026
•
Peter Claridge

WordPress Adds an Automatic Safety Gate for Plugin Updates

WordPress.org is adding automated security checks to plugin and theme releases before they reach websites through its update API. The move follows the discovery of a backdoor in a plugin used by about 20,000 sites. High-risk releases can now be blocked automatically, reducing the chance that harmful code reaches users while developers are offline. Key…
Read More

Read article →: WordPress Adds an Automatic Safety Gate for Plugin Updates
19 Sep 2026
•
Peter Claridge

The Events Calendar flaws put 600,000 WordPress sites at risk

Two critical vulnerabilities in The Events Calendar WordPress plugin could allow unauthenticated attackers to take control of affected websites. The flaws can enable remote code execution, administrator password resets and malware installation. With more than 600,000 active installations, site owners should treat updating the plugin as an urgent maintenance task. Key takeaways Two flaws, CVE-2026-78006…
Read More

Read article →: The Events Calendar flaws put 600,000 WordPress sites at risk
16 Sep 2026
•
Peter Claridge

Elementor Pro flaw under attack: WordPress sites urged to update now

Attackers are actively exploiting a critical vulnerability in Elementor Pro, the popular WordPress website builder, to upload and run malicious PHP files. The flaw can allow unauthenticated attackers to take complete control of affected sites. Administrators should update immediately and check their websites for signs of compromise. Key takeaways The vulnerability is rated critical, with…
Read More

Read article →: Elementor Pro flaw under attack: WordPress sites urged to update now
14 Sep 2026
•
Peter Claridge

THEMIS puts WordPress plugins under the security microscope

A new security testing tool could help WordPress developers find plugin vulnerabilities before criminals do. Called THEMIS, the framework is designed to understand how plugins interact with WordPress, allowing it to uncover flaws that traditional web fuzzers often miss. Its early tests found 10 previously unknown vulnerabilities across real-world plugins. Key takeaways THEMIS is designed…
Read More

Read article →: THEMIS puts WordPress plugins under the security microscope
12 Sep 2026
•
Peter Claridge

Critical WordPress plugin flaw puts more than five million sites at risk of takeover

A critical flaw in the popular All-in-One WP Migration and Backup plugin could let unauthenticated attackers take complete control of vulnerable WordPress websites. The issue, tracked as CVE-2026-19949, affects versions up to 7.109 and has been fixed in version 7.110. Website owners should act quickly, even if no suspicious activity is visible. Key takeaways CVE-2026-19949…
Read More

Read article →: Critical WordPress plugin flaw puts more than five million sites at risk of takeover
9 Sep 2026
•
Peter Claridge

Elementor Pro Vulnerability Exploited in Active WordPress Attacks: What Site Owners Need to Know

A critical vulnerability in Elementor Pro is reportedly being used in active cyberattacks against WordPress websites running vulnerable versions of the popular page builder. The incident highlights the risks of delayed updates and shows why regular monitoring, backups and a reliable WordPress maintenance plan are essential for website owners. Key takeaways Security reports indicate that…
Read More

Read article →: Elementor Pro Vulnerability Exploited in Active WordPress Attacks: What Site Owners Need to Know
7 Sep 2026
•
Peter Claridge

WordPress sites under attack as Super Forms and Elementor Pro flaws fuel mass exploitation

WordPress site owners are being targeted by a wave of attacks abusing critical vulnerabilities in the Super Forms and Elementor Pro plugins. Security researchers say more than 440,000 exploitation attempts have been blocked, with attackers uploading PHP webshells that can provide remote control of affected websites. Key takeaways The incidents affect widely used WordPress tools…
Read More

Read article →: WordPress sites under attack as Super Forms and Elementor Pro flaws fuel mass exploitation
5 Sep 2026
•
Peter Claridge

Critical Everest Forms flaw puts 100,000 WordPress sites at risk of takeover

A serious vulnerability in the Everest Forms WordPress plugin could allow unauthenticated attackers to upload and run malicious PHP files on affected websites. More than 100,000 sites may be exposed. The flaw creates a potential route to remote code execution, data theft, website defacement and complete site takeover. Key takeaways CVE-2026-19598 affects Everest Forms versions…
Read More

Read article →: Critical Everest Forms flaw puts 100,000 WordPress sites at risk of takeover
2 Sep 2026
•
Peter Claridge

Critical GiveWP flaw puts WordPress donation sites at risk of server takeover

A critical vulnerability in the GiveWP WordPress donation plugin could allow attackers to run operating-system commands on affected servers. Tracked as CVE-2026-82222 and rated CVSS 10.0, the flaw affects versions up to 4.16.7.1. GiveWP has more than 100,000 installations, making urgent updates important for charities and other organisations. Key takeaways GiveWP versions through 4.16.7.1 are…
Read More

Read article →: Critical GiveWP flaw puts WordPress donation sites at risk of server takeover
31 Aug 2026
•
Peter Claridge

Fake reCAPTCHA Trap Turns WordPress Websites into Windows Credential Theft Machines

Hundreds of compromised WordPress websites are reportedly being used to display fake reCAPTCHA checks and deliver malware to Windows visitors. The campaign combines malicious plugins, browser persistence, blockchain-hosted instructions and “ClickFix” social engineering to install Amatera, an information stealer designed to capture browser passwords and other sensitive data. Key takeaways Fake CAPTCHA pages instruct visitors…
Read More

Read article →: Fake reCAPTCHA Trap Turns WordPress Websites into Windows Credential Theft Machines