Vulnerabilities
WordPress Sites Face Critical Risk: Unauthenticated Code Execution in Avala Plugin
A critical vulnerability in the Avala plugin allows attackers to execute code without credentials on WordPress sites.
WordPress
Everything Cipher Insider has reported about WordPress: 4 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Sites using WooCommerce 3D Configurator Face Critical No-Auth RCE Risk via Single POST Request
A critical flaw in the 3D Product Configurator for WooCommerce allows remote code execution without authentication, affecting versions up to 2.16.2.
Vulnerabilities
Organisations Urged to Patch ThemeREX IPharm Plugin Amid Critical CVE-2026-93936 Object Injection Risk
A severe vulnerability in the IPharm plugin allows object injection, affecting versions up to 1.2.4 and requiring immediate attention from administrators.
Vulnerabilities
WordPress Sites Exposed to Critical Deserialization Risk in Hogwords Plugin
The ThemeREX Hogwords plugin contains a severe flaw allowing object injection, affecting all versions up to 1.2.7 with a maximum severity score.