Curated security research, vulnerabilities, advisories and tools for practitioners.

#wordpress

Security coverage tagged wordpress.

1.

CVE-2026-32475: Elementor Pro Forms Unauthenticated Arbitrary File Upload to RCE Lab & PoC

vulnerability | Critical | 2026-09-05 06:23 | CVE-2026-32475 | github.com | original ↗ | #bug-bounty | #rce | #wordpress

2.

dinosn/givewp-cve-2026-82222-rce-lab: GiveWP CVE-2026-82222 RCE Docker Lab & PoC

research | 2026-08-30 05:15 | CVE-2026-82222 | github.com | original ↗ | #rce | #php | #wordpress

3.

Philippine Nuclear Agency and Naval Contractor Targeted by Suspected Chinese-Speaking Operator Using Known Vulnerabilities

blog | 2026-08-26 00:00 | CVE-2023-49105 | hunt.io | original ↗ | #rce | #threat-intelligence | #attack-surface

4.

XSS2Shell: WordPress pre-auth XSS to RCE chain (CVE-2026-64638)

vulnerability | High | 2026-08-07 15:25 | CVE-2026-64638 | pwn.ai | original ↗ | #ai-security | #rce | #public-poc

5.

CVE-2026-15748 — WPMU DEV Forminator Forms Select Field Injection Unrestricted File Upload

research | 2026-08-18 00:00 | CVE-2026-15748 | aretiq.ai | original ↗ | #ai-security | #rce | #wordpress

6.

CVE-2026-61967 — miniOrange OTP Verification Ultimate Member Password Reset Authentication Bypass

research | 2026-08-15 00:00 | CVE-2026-61967 | aretiq.ai | original ↗ | #ai-security | #authentication-bypass | #wordpress

7.

Unauthenticated RCE in WordPress core (wp2shell), via SQL injection

vulnerability | Critical | 2026-07-17 00:00 | CVE-2026-63030 | aikido.dev | original ↗ | #rce | #featured | #vulnerability-research

8.

SQL injection isn't dead

blog | 2026-07-22 00:00 | aikido.dev | original ↗ | #ai-security | #rce | #appsec

9.

Exploitation in the Wild of wp2shell

blog | 2026-07-20 18:00 | wiz.io | original ↗ | #rce | #wordpress | #vulnerability

10.

How Two WordPress Core Bugs Chained into Pre-Auth RCE

research | 2026-07-18 00:00 | bugbunny.ai | original ↗ | #rce | #vulnerability-research | #attack-chains

11.

CVE-2026-8206 — Themeum Kirki WordPress Plugin Password Reset Email Redirect Privilege Escalation

research | 2026-06-02 00:00 | CVE-2026-8206 | aretiq.ai | original ↗ | #appsec | #vulnerability-research | #account-takeover

12.

CVE-2026-48866 — WordPress Gravity Forms Plugin File Upload Path Traversal Arbitrary File Deletion

research | 2026-06-01 00:00 | CVE-2026-48866 | aretiq.ai | original ↗ | #vulnerability-research | #web-security | #wordpress

13.

Critical auth bypass in WordPress Azure AD SSO plugin due to missing OIDC id_token validation

vulnerability | Critical | 2026-04-10 07:36 | CVE-2026-2628 | yeswehack.com | original ↗ | #cloud | #authentication-bypass | #wordpress

14.

URLx Just Got Bigger: 10.6B URLs for Recon and Malicious Infrastructure Hunting

blog | 2025-03-27 00:00 | hunt.io | original ↗ | #wordpress | #threat-hunting | #dprk

15.

Wordpress Plugin Vulnerability Hunting

vulnerability | 2024-08-27 05:01 | projectblack.io | original ↗ | #vulnerability-research | #wordpress | #sast

16.

XBOW Battles Ninja Tables: Who’s the Real Ninja?

vulnerability | 2024-08-14 12:00 | xbow.com | original ↗ | #bug-bounty | #arbitrary-file-read | #vulnerability-research

17.

How Serialized Cookies Led to RCE on a WordPress Website

blog | 2024-05-09 16:11 | hackerone.com | original ↗ | #bug-bounty | #rce | #nextcloud

18.

WP Coder, Version 2.5.3 Advisory

vulnerability | 2023-04-13 00:00 | CVE-2023-0895 | bishopfox.com | original ↗ | #sql-injection | #wordpress | #vulnerability

19.

Log HTTP Requests, Version 1.3.1, Advisory

vulnerability | 2022-11-21 00:00 | CVE-2022-3402 | bishopfox.com | original ↗ | #web-security | #wordpress | #xss

20.

Novel Attack Vector to Bypass CSP Via Same Origin Method Execution (Wordpress Zeroday)

blog | 2022-05-29 11:00 | pwn.ai | original ↗ | #vulnerability-research | #wordpress | #xss

21.

Reports from the Field: Part 1

blog | 2022-03-01 00:00 | bishopfox.com | original ↗ | #data-exposure | #wordpress | #incident-analysis

22.

Top 10 web hacking techniques of 2018

research | 2021-01-05 14:10 | portswigger.net | original ↗ | #web-security | #wordpress | #research