Everything SecOps Monitor has reported about WordPress: 4 stories, newest first. Part of our Vulnerabilities coverage.
Unauthenticated attackers can gain admin access via a flaw in WordPress User Profile Builder versions up to 4.0.3 if legacy role fields persist.
A critical object injection flaw in Travesia versions up to 1.1.16 allows untrusted data deserialization, posing severe risks to site security.
A critical flaw in the Advanced IP Blocker plugin allows attackers to bypass two-factor authentication and seize full WordPress admin access without a password.
The NVD rates this deserialization flaw as critical with a 9.8 score, impacting ThemeREX Smash versions up to 1.12.0 through object injection.