Tech News
UpdraftCentral Connection Key Breach Allows Malicious Plugin Installation
TeamUpdraft disclosed that attackers accessed its website and stole credentials, enabling them to install harmful software on customer WordPress sites.
WordPress
Everything Vector Bulletin has reported about WordPress: 6 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
SQL Injection in Mang Board WP Plugin Exposes Sites to Database Attacks
A critical flaw in the Mang Board WordPress plugin allows attackers to inject malicious SQL commands, risking significant data exposure for site administrators.
Vulnerabilities
AGE-GATE Plugin 1.0 Critical: Unauthenticated RCE via Unsanitized POST in admin.php
All versions of the AGE-GATE plugin up to 1.0 contain a critical flaw allowing attackers to execute code without logging in, according to NVD records.
Vulnerabilities
Juno WordPress Theme Critical RCE Flaw: CVE-2026-62086 Allows Unauth Code Exec in v2.25
The NVD rates CVE-2026-62086 as critical. ThemeREX’s Juno theme allows remote code execution without credentials in versions up to 2.25.
Vulnerabilities
PPOM WooCommerce Path Traversal Flaw Exposes wp-config.php for Deletion and Public Data Read Access
Unauthenticated attackers can delete server files and read data via a path traversal flaw in the PPOM WooCommerce plugin, risking full site compromise.
Vulnerabilities
Gutentype Plugin Object Injection Vulnerability: CVSS 9.8 Threatens Versions Up to 2.1.12
The National Vulnerability Database has assigned a CVSS 9.8 score to an object injection vulnerability in the ThemeREX Gutentype WordPress plugin.