Vulnerabilities across WordPress core and its plugin and theme ecosystem — the sprawling third-party attack surface that runs a large share of the public web, where a single popular plugin flaw can cascade into hundreds of thousands of compromised sites within days of disclosure. Combined article + CVE feed for the WordPress beat.https://0daynews.com/en-ushttps://0daynews.com/articles/2026-09-04-all-in-one-wp-migration-cve-2026-19949-sql-injection/https://0daynews.com/articles/2026-09-04-all-in-one-wp-migration-cve-2026-19949-sql-injection/Unauthenticated SQL injection in All-in-One WP Migration and Backup plugin (versions through 7.109) enables data theft and conditional RCE. Update immediately.Fri, 04 Sep 2026 10:00:00 GMTWordPressarticlehttps://0daynews.com/articles/2026-09-04-elementor-pro-cve-2026-32475-wordpress-webshell/https://0daynews.com/articles/2026-09-04-elementor-pro-cve-2026-32475-wordpress-webshell/Attackers are exploiting CVE-2026-32475, a critical file upload flaw in Elementor Pro, to deliver webshells to WordPress sites running version 4.2.1 or earlier.Fri, 04 Sep 2026 06:00:00 GMTWordPressarticlehttps://0daynews.com/cve/cve-2019-9978/https://0daynews.com/cve/cve-2019-9978/WordPress Social Warfare plugin contains a cross-site scripting (XSS) vulnerability that allows for remote code execution. This vulnerability affects Social Warfare and Social Warfare Pro.Thu, 03 Sep 2026 00:00:00 GMTWordPressmediumcvehttps://0daynews.com/cve/cve-2020-11738/https://0daynews.com/cve/cve-2020-11738/WordPress Snap Creek Duplicator plugin contains a file download vulnerability when an administrator creates a new copy of their site that allows an attacker to download the generated files from their Wordpress dashboard. This vulnerability affects Duplicator and Dulplicator Pro.Thu, 03 Sep 2026 00:00:00 GMTWordPresshighcvehttps://0daynews.com/cve/cve-2020-25213/https://0daynews.com/cve/cve-2020-25213/WordPress File Manager plugin contains a remote code execution vulnerability that allows unauthenticated users to execute PHP code and upload malicious files on a target site.Thu, 03 Sep 2026 00:00:00 GMTWordPresscriticalcvehttps://0daynews.com/cve/cve-2026-60137/https://0daynews.com/cve/cve-2026-60137/A medium-severity SQL injection in WordPress WP_Query's author__not_in parameter (CVE-2026-60137). Tracked as the wp2shell companion. Patched in 6.8.6, 6.9.5, and 7.0.2.Thu, 03 Sep 2026 00:00:00 GMTWordPressmediumcvehttps://0daynews.com/cve/cve-2026-63030/https://0daynews.com/cve/cve-2026-63030/A critical unauthenticated remote code execution flaw in WordPress Core (CVE-2026-63030). GitHub Security Advisory issued July 17, 2026; public PoC circulating.Thu, 03 Sep 2026 00:00:00 GMTWordPresscriticalcvehttps://0daynews.com/articles/2026-08-31-profile-builder-unauth-file-upload-cve-2026-82607/https://0daynews.com/articles/2026-08-31-profile-builder-unauth-file-upload-cve-2026-82607/Cozmoslabs Profile Builder for WordPress up to 3.16.1 lets unauthenticated attackers upload files via the avatar AJAX endpoint. Patch or mitigate now.Mon, 31 Aug 2026 06:00:00 GMTWordPressarticlehttps://0daynews.com/articles/2026-08-27-avada-wordpress-zero-click-rce-cve-2026-18431/https://0daynews.com/articles/2026-08-27-avada-wordpress-zero-click-rce-cve-2026-18431/ThemeFusion patches a six-flaw chain in Avada and Fusion Builder that lets unauthenticated attackers execute arbitrary PHP code. CVSS 9.8 Critical.Thu, 27 Aug 2026 07:00:00 GMTWordPressarticlehttps://0daynews.com/articles/2026-08-25-miniorange-saml-wordpress-auth-bypass-exploited/https://0daynews.com/articles/2026-08-25-miniorange-saml-wordpress-auth-bypass-exploited/Two authentication bypass flaws in the miniOrange SAML 2.0 SSO plugin are being actively exploited for WordPress admin takeover. Update immediately.Tue, 25 Aug 2026 16:00:00 GMTWordPressarticlehttps://0daynews.com/articles/2026-08-18-forminator-wordpress-cve-2026-15748-rce/https://0daynews.com/articles/2026-08-18-forminator-wordpress-cve-2026-15748-rce/CVE-2026-15748 (CVSS 9.8) in Forminator Forms lets unauthenticated attackers upload PHP files and achieve remote code execution. Update immediately.Tue, 18 Aug 2026 08:00:00 GMTWordPressarticlehttps://0daynews.com/articles/2026-08-16-wordpress-pods-link-library-critical-vulns/https://0daynews.com/articles/2026-08-16-wordpress-pods-link-library-critical-vulns/Pods (CVSS 9.8) and Link Library (CVSS 9.1) expose WordPress sites to unauthenticated privilege escalation and arbitrary file deletion with RCE potential.Sun, 16 Aug 2026 22:00:00 GMTWordPressarticlehttps://0daynews.com/articles/2026-08-15-maxupload-cve-2026-15965-file-upload/https://0daynews.com/articles/2026-08-15-maxupload-cve-2026-15965-file-upload/CVE-2026-15965: MaxUpload (≤1.4.0) lets unauthenticated attackers upload arbitrary files via a filename validation mismatch between chunk and final assembly. CVSS 8.8, no patch confirmed.Sat, 15 Aug 2026 22:00:00 GMTWordPressarticlehttps://0daynews.com/articles/2026-08-15-wordpress-plugin-auth-bypass-critical-cvss98/https://0daynews.com/articles/2026-08-15-wordpress-plugin-auth-bypass-critical-cvss98/Two WordPress plugins patched this week carry CVSS 9.8 authentication bypass flaws. A third allows unauthenticated file deletion that hands attackers RCE.Sat, 15 Aug 2026 20:00:00 GMTWordPressarticlehttps://0daynews.com/articles/2026-08-14-wordpress-704-rce-imagick-ghostscript/https://0daynews.com/articles/2026-08-14-wordpress-704-rce-imagick-ghostscript/WordPress 7.0.4 fixes a high-severity RCE allowing Author-level accounts to execute code via malicious PostScript files. Update now.Fri, 14 Aug 2026 10:00:00 GMTWordPressarticlehttps://0daynews.com/articles/2026-08-10-wp-login-register-cve-2026-18468-18469-18470/https://0daynews.com/articles/2026-08-10-wp-login-register-cve-2026-18468-18469-18470/Three CVEs in the Login & Register Forms WordPress plugin before 4.0.2 enable unauthenticated account takeover, including site admins. Update now.Mon, 10 Aug 2026 04:00:00 GMTWordPressarticlehttps://0daynews.com/articles/2026-07-21-cisa-kev-wp2shell-both-cves-added-bod-26-04-federal-clock/https://0daynews.com/articles/2026-07-21-cisa-kev-wp2shell-both-cves-added-bod-26-04-federal-clock/CISA added both wp2shell CVEs — CVE-2026-63030 RCE and CVE-2026-60137 SQLi — to KEV on July 21. BOD 26-04 clock runs; SQLi is now framed as chainable.Wed, 22 Jul 2026 03:00:00 GMTWordPressarticlehttps://0daynews.com/articles/2026-07-21-wp2shell-mass-scanning-kevintel-watchtowr-wiz-fuse-triage/https://0daynews.com/articles/2026-07-21-wp2shell-mass-scanning-kevintel-watchtowr-wiz-fuse-triage/Four vendors — KEVIntel, watchTowr, Wiz, Cloudflare — now confirm mass scanning of the wp2shell RCE. CMSmap webshells and backdoor admin accounts observed.Tue, 21 Jul 2026 15:15:00 GMTWordPressarticlehttps://0daynews.com/articles/2026-07-20-wp2shell-first-exploitation-cve-2026-60137-sqli-companion-patched/https://0daynews.com/articles/2026-07-20-wp2shell-first-exploitation-cve-2026-60137-sqli-companion-patched/watchTowr reports first signs of in-the-wild exploitation of the WordPress Core wp2shell RCE. The pending companion CVE-2026-60137 SQLi has landed, and exact patched versions are 6.9.5 and 7.0.2.Mon, 20 Jul 2026 01:15:00 GMTWordPressarticlehttps://0daynews.com/articles/2026-07-18-wordpress-core-cve-2026-63030-wp2shell-rce-poc-public/https://0daynews.com/articles/2026-07-18-wordpress-core-cve-2026-63030-wp2shell-rce-poc-public/A critical unauthenticated remote code execution flaw in WordPress Core got a CVE, a GitHub advisory, and a working public PoC on July 17, 2026.Sat, 18 Jul 2026 13:05:00 GMTWordPressarticle