ThreatVectr
Tag

#plugin security

10 stories taggedplugin security.

Illustration: a glowing laptop screen showing an abstract broken padlock icon over a blurred website layout grid
Vulnerabilities

Hackers Are Breaking Into WordPress Sites Through a Bricksforge Plugin Flaw

A rated-critical bug in the Bricksforge plugin lets strangers upload and run their own code on affected sites. Patch now.

4 min read
Illustration: a darkened laptop screen showing an abstract website admin dashboard with a glowing red cursor hovering
Vulnerabilities

Elementor Flaw Lets Attackers Hijack WordPress Sites With a Single Admin Click

A cross-site request forgery bug in the popular page-builder plugin can create rogue admin accounts if a logged-in administrator visits a booby-trapped page.

4 min read
A WordPress dashboard with the plugin update screen open, security scan progress bars showing active analysis of plugin code, detected threats flagged in red
Policy & Regulation

WordPress Will Now Scan Every Plugin Update for Malicious Code

The world's biggest website platform is adding automated security checks to plugin updates, after years of criminals sneaking malware into trusted software.

3 min read
An e-commerce website backend showing a file upload dialog box, with PHP webshell code visible in the editor beneath, and an alert badge showing blocked attack
Vulnerabilities

WordPress plugin flaw is being used to plant hidden backdoors on shop sites

A file-upload bug in WooCommerce Wholesale Lead Capture lets attackers drop PHP webshells with no login required. Wordfence has blocked more than 100,000 attempts.

4 min read
A computer monitor displaying a compromised website homepage with subtle visual corruptions and overlay glitches, surrounded by scattered cables and keyboard in
Breaches

Hacker Backdoored a WordPress Plugin's Own Website, Hitting 1,500 Sites

The maker of Admin Menu Editor Pro says an attacker took over his site and shipped two poisoned updates that installed a hidden admin account on customer sites.

3 min read
A WordPress admin dashboard displaying a plugin interface with upload fields and file manager sections, with a warning banner about unauthorized file access vis
Vulnerabilities

Elementor Pro flaw let attackers plant executable files on WordPress sites

A bug in the paid version of the popular WordPress builder let strangers upload PHP files and run code on the server. A patch is out.

4 min read
A WordPress dashboard displaying the Forminator plugin panel, with a file upload interface prominently shown and warning symbols indicating the critical vulnera
Vulnerabilities

Forminator WordPress Plugin Carries Critical Flaw Rated 9.8; 600,000 Sites Affected

A newly disclosed vulnerability in the Forminator plugin lets attackers upload malicious files without logging in, putting hundreds of hundreds of WordPress sites at risk of full takeover.

3 min read
A WordPress admin dashboard displaying installed plugins including Element Pack, a hidden admin account notification visible in a suspicious log entry, maliciou
Vulnerabilities

Hackers hijacked BdThemes WordPress plugins to quietly create secret admin accounts

A poisoned promotional feed pushed malicious code to admin dashboards, spawning hidden accounts on sites running Element Pack and other BdThemes plugins.

3 min read
Illustration: a dimly lit server rack with one Ethernet cable glowing faint red while the others glow blue
Threat Intelligence

ShapedPlugin's Update Channel Hijacked, Pro Plugins Shipped with Backdoor

Attackers slipped malicious code into licensed Pro releases by compromising the vendor's own build pipeline, a clean supply-chain hit on WordPress installs.

2 min read
Illustration: A close-up, macro
Vulnerabilities

Privilege Escalation Attacks Hit Kirki and Burst Statistics WordPress Plugins

Threat actors are actively exploiting flaws in two widely-used WordPress plugins to grab admin access and seize site control.

2 min read
© 2026 Threat Vectr