Experts warn millions of WordPress websites could be at risk following reveal of worrying bugs

Hackers are chaining together two newly discovered flaws to achieve remote code execution.
Gadget Review on MSN

Hackers exploit patched WordPress bugs – millions of sites still at risk

WordPress WP2Shell vulnerabilities expose millions of unpatched sites to full remote takeover - update to 7.0.2 now to stay ...

Critical wp2shell WordPress flaws exploited to install webshells

Hackers are exploiting the "wp2shell" critical vulnerability suite (CVE-2026-63030 and CVE-2026-60137) affecting WordPress ...

wp2shell: Critical WordPress vulnerability allows code injection via API

By chaining an SQL injection and an API vulnerability, attackers can inject code. WordPress has released an update, the ...
CSO Online

Patch now: WordPress REST API bug allows remote code execution

The flaw affects WordPress Core’s REST Batch API, allowing unauthenticated attackers to execute code on vulnerable sites.

Attackers pummel critical WordPress vuln to create all sorts of mischief

Just hours after fixes came out, attackers have begun exploiting two bugs that, when chained together, allow ...

WordPress Core "wp2shell" RCE flaws get public exploits, patch now

Public exploits have been released for the critical "wp2shell" remote code execution vulnerabilities affecting WordPress Core ...
Searchenginejournal.com

Why WordPress 6.9 Abilities API Is Consequential And Far-Reaching

WordPress 6.9, scheduled for release on December 2, 2025, is shipping with a new Abilities API that introduces a new system designed to make advanced AI-driven functionality possible for themes and ...
Searchenginejournal.com

Security Researcher: WordPress 7.0 Could Trigger Rush To Steal AI API Keys

Oliver Sild, founder of Patchstack WordPress security company, shared concerns about the security of AI API keys in WordPress 7.0, sharing that there “will be an absolute rush by hackers to steal API ...