Everything RedTeam Tribune has reported about WordPress: 4 stories, newest first. Part of our Vulnerabilities coverage.
Attackers can trigger remote code execution or file deletion on WordPress sites using Duplicator versions prior to the latest release, requiring no authentication.
Two high-severity vulnerabilities in PHP, both rated 9.2, will be patched in an update scheduled for October 21, 2026, affecting all dependent applications.
Unauthenticated attackers can reset passwords for any user in WordPress multi-site installations running vulnerable versions of the Theme My Login plugin.
A critical flaw in the 3D Product Configurator plugin allows unauthenticated attackers to execute arbitrary code on WordPress servers via a single POST request.