Topic

WordPress: news, advisories and analysis

8 articlesUpdated 1 Nov 2026

CyberSecureToday covers WordPress across 8 articles published between 17 Sep 2026 and 1 Nov 2026. The coverage includes 8 vulnerability advisories. 8 advisories are rated critical or high severity, and 3 involve flaws listed in CISA's Known Exploited Vulnerabilities catalog.

Stories on WordPress most often intersect with CMS Security, WooCommerce and E-Commerce Security, with Technology, Cloud & SaaS the most affected sector. The most recent story, “WordPress Core Upgrade-Window Staging Race Condition RCE Draws 63,000 Attacks in 24 Hours (CVE-2026-119977)”, was published 1 Nov 2026. Every article is listed below, newest first, with the affected products, severity and remediation guidance in each piece.

Latest coverage

ThreatsCloud & SaaSHigh
WordPress Core Upgrade-Window Staging Race Condition RCE Draws 63,000 Attacks in 24 Hours (CVE-2026-119977)
CVE-2026-119977, an unauthenticated upgrade-window race condition in WordPress Core versions 4.7 to 7.1.3, was targeted in 63,000 automated exploitation probes.
Priya Raman1 Nov 202612 min read
ThreatsCloud & SaaSCritical
WordPress REST API Flaw Exposed Hidden and Private bbPress Forum Content to Unauthenticated Scraping
A broken object authorization flaw in the WordPress core REST API enabled unauthenticated attackers to read private and hidden bbPress forum posts.
Daniel Okafor18 Oct 202613 min read
ThreatsCloud & SaaSCritical
JTL-Connector for WooCommerce Unrestricted File Upload Flaw CVE-2026-87855 Patched
JTL patches a critical arbitrary file upload vulnerability in JTL-Connector for WooCommerce (CVE-2026-87855) allowing unauthenticated web shell execution.
Priya Raman14 Oct 20268 min read
ThreatsCloud & SaaSHigh
SimpleForm WordPress Plugin Flaw Lets Visitors Register as Admin
WordPress security advisory resolves a high-severity privilege escalation flaw in SimpleForm (CVE-2026-104748) allowing unauthenticated users to register as admin.
Priya Raman14 Oct 20268 min read
ThreatsCloud & SaaSCritical
Abandoned Cart Pro for WooCommerce Insecure Deserialization Flaw CVE-2026-97657 Patched
Tyche Softwares resolves a critical PHP object injection flaw in Abandoned Cart Pro for WooCommerce (CVE-2026-97657) enabling unauthenticated remote code execution.
Priya Raman14 Oct 20268 min read
ThreatsCloud & SaaSCritical
Abandoned Cart Pro SQL Injection Exposes WooCommerce Customer Records
Tyche Softwares resolves an unauthenticated blind SQL injection flaw in Abandoned Cart Pro (CVE-2026-97668) allowing extraction of customer and order records.
Mei-Lin Chen14 Oct 20268 min read
ThreatsCloud & SaaSCritical
WordPress Core Template Traversal Flaw Weaponized for Remote Code Execution
WordPress releases emergency update 7.1.2 to patch critical path traversal flaw CVE-2026-87902 in get_page_template() weaponized in active web attacks.
Mei-Lin Chen26 Sep 202614 min read
ThreatsCloud & SaaSCritical
WordPress Core Critical SQL Injection Flaw CVE-2026-60137 Exploited in Mass Web Attacks
CISA incorporates WordPress Core vulnerabilities CVE-2026-60137 and CVE-2026-63030 (CVSS 9.8) into KEV catalog following active in-the-wild web attacks.
CST Editorial Desk17 Sep 202614 min read