WordPress has shipped an urgent security update after the discovery of CVE-2026-87902, a critical unauthenticated path traversal flaw in WordPress Core that can, under the right conditions, lead to remote code execution. The WordPress Security Team released WordPress 7.1.2 on…
A Wordfence threat-intelligence analysis has exposed a malicious WordPress must-use plugin that is built to stay hidden, resist removal, and keep its foothold even after cleanup attempts. The malware uses self-healing routines, account abuse, dashboard hiding tricks, and EtherHiding —…
Wordfence Intelligence’s weekly WordPress vulnerability report for September 7 to September 13, 2026 shows another busy seven days for the ecosystem, with 260 vulnerabilities disclosed across 207 WordPress plugins and 147 researchers contributing findings. The latest report highlights a mix…
Wordfence says a newly disclosed vulnerability in Tutor LMS, a WordPress e-learning plugin active on more than 100,000 websites, could let authenticated attackers with subscriber-level access reach remote code execution on the server. The issue, tracked as CVE-2026-78175 and rated…
Attackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin for WordPress, with Wordfence saying it has already blocked more than 100,000 exploit attempts. The flaw, tracked as CVE-2026-27540, can let unauthenticated attackers upload arbitrary files,…
Wordfence says its Argus threat intelligence team uncovered two critical, unauthenticated vulnerability chains in The Events Calendar WordPress plugin, both capable of leading to remote code execution on sites running vulnerable versions. The issues affected releases up to 6.17.4 and…
Wordfence Intelligence says 277 WordPress vulnerabilities were disclosed last week across 187 plugins and seven themes, with 153 researchers contributing findings to the database between August 31, 2026 and September 6, 2026. The weekly report shows a mix of patched…
Wordfence’s latest weekly report shows another busy seven days for the WordPress ecosystem: 246 vulnerabilities were disclosed across 174 plugins and five themes added to the Wordfence Intelligence Vulnerability Database between August 24 and August 30, 2026. Of those, 234…
Wordfence says its Argus research system uncovered a high-severity unauthenticated arbitrary file upload flaw in the popular Gravity Forms WordPress plugin, affecting versions 3.0.2 and earlier and potentially allowing remote code execution on some server setups. The company disclosed the…
Attackers are actively exploiting a critical vulnerability in the Super Forms WordPress plugin, and Wordfence says its firewall has already blocked more than 250,000 attempts. The flaw affects versions 6.3.313 and earlier, can be abused without authentication, and may let…
Aaron D. Campbell says WordPress security is entering a faster, more complicated era, driven in large part by AI. In a WP Tavern Jukebox Podcast episode recorded at WordCamp US, Campbell described how attackers and defenders are now locked in…
Attackers are actively exploiting a critical Elementor Pro vulnerability that can let unauthenticated users upload arbitrary files, including PHP payloads that may lead to remote code execution and full site takeover. Wordfence says its firewall has already blocked more than…
A high-severity SQL injection vulnerability in the All-in-One WP Migration and Backup WordPress plugin affects versions up to 7.109 and could let unauthenticated attackers reach remote code execution under the right conditions, according to Wordfence. The plugin has more than…
Wordfence Intelligence’s weekly WordPress vulnerability report for August 17 to August 23, 2026 shows another heavy seven days for the ecosystem: 240 vulnerabilities were disclosed across 184 plugins and 17 themes added to the database, with 105 researchers contributing findings….
Wordfence says its Argus research tool uncovered a critical authentication bypass in the WPMU DEV Dashboard WordPress plugin, a flaw that could let unauthenticated attackers reach administrator access on sites using Hub Single-Sign On. The issue affects versions up to…
TranslatePress, a WordPress plugin with more than 400,000 active installations, has been found vulnerable to an unauthenticated account takeover flaw that can expose an administrator’s password reset link and lead to full site compromise. Wordfence says the issue affects versions…
Wordfence Intelligence’s weekly WordPress vulnerability report for August 10 to August 16, 2026 shows another heavy seven-day stretch for the ecosystem, with 259 vulnerabilities disclosed across 199 plugins and five themes. Of those issues, 204 were already patched and 55…
Wordfence says a critical arbitrary file upload flaw in Elementor Pro, a WordPress plugin with an estimated 6 million active installations, could let unauthenticated attackers upload executable PHP files and potentially take over a site. The issue, tracked as CVE-2026-32475…
Wordfence Intelligence says 247 WordPress vulnerabilities were disclosed last week across 195 plugins and two themes, with 135 researchers contributing new findings to the database between August 3, 2026 and August 9, 2026. The weekly report highlights a mix of…
Wordfence says a critical authentication bypass in the User Profile Builder WordPress plugin could let unauthenticated attackers log in as a site’s administrator on affected installations, putting more than 40,000 active sites at risk. The issue affects versions up to…
Hashe Computer Solutions (Pvt) Ltd. was established in 1998 and is a global consulting and IT services company. Hashe provides expert analysts and development teams, who translate corporate strategies into creative, robust, and cost-effective systems that leverage a client's unique competitive advantage resulting in shorter time-to-market cycles. We also offer complete outsourcing solutions from software development to after development mission-critical-level support.
225 Cavalry Grounds, Street 5,
Lahore 54810, Pakistan.
Director & CEO