WordPress Backdoor Uses Ethereum Smart Contracts to Hide Command-and-Control Servers
The malware, found during a site cleanup in mid-June, disguises itself as a legitimate must-use plugin and includes several mechanisms to survive removal.
Must-use...
Hackers Breach Government WordPress Site and Steal 18,566 Records With Plaintext Passwords
The breach was part of a wider campaign targeting vulnerable WordPress installations worldwide. The activity from May 7, 2026 onward to a single malicious...
Tutor LMS PHP Object Injection Flaw Lets Attackers Plant Web Shells on WordPress Sites
A critical vulnerability in the Tutor LMS WordPress plugin could allow low-privileged users to execute code remotely and plant web shells on vulnerable websites.
Wordfence...
WooCommerce Plugin Bug Lets Remote Attackers Create Admin Accounts and Take Over Sites
A critical security flaw in the WooCommerce Wholesale Lead Capture plugin is being actively exploited, allowing remote attackers to upload malicious files and potentially...
WordPress Service Worker Uses EtherHiding, ClickFix and Steganography to Deploy Amatera Stealer
The campaign has affected hundreds of WordPress websites. Attackers plant a rogue must-use plugin, named in the format site-helper-<hex>, that loads automatically with the...