A high-severity vulnerability in the All-in-One WP Migration and Backup plugin could allow unauthenticated attackers to take over vulnerable WordPress sites. The flaw, tracked as CVE-2026-19949, affects more than 5 million active installations and has been fixed in version 7.110.

The issue was reported to Wordfence on August 14, 2026, by security researcher Jack Taylor through the Wordfence Bug Bounty Program. Taylor received a $5,761 bounty for discovering the vulnerability, which received a CVSS score of 8.8.

All-in-One WP Migration and Backup is widely used to export, import, restore, and migrate WordPress sites. It creates .wpress archive files containing website files and database data.

The vulnerable versions, up to and including 7.109, contain an unauthenticated second-order SQL injection flaw in the archive restore process.

Unlike a typical SQL injection attack, the malicious SQL code is not executed immediately. An attacker can first place a specially crafted payload in a WordPress site through the core trackback feature. Trackbacks can be submitted without logging in when a public post accepts pings.

WordPress All-in-One WP Migration Plugin Flaw

The attacker submits malicious trackback data with a carefully prepared blog name and URL. WordPress stores that data in the comments table. At this stage, the payload remains inactive and appears to be ordinary comment-related data.

The attack becomes dangerous when a site administrator exports the website using the plugin and later restores it. During restoration, All-in-One WP Migration rewrites URLs and database table prefixes in SQL statements before importing them.

According to a Wordfence report, a flaw in the plugin’s regular expression handling of backslashes and quoted strings can cause the stored payload to escape its intended SQL string boundary.

As a result, attacker-controlled content can become executable SQL during the database restore process. The injected SQL can retrieve the plugin’s ai1wm_secret_key, a secret value used to protect the plugin’s unauthenticated import action.

The attacker can then leak this secret key into an approved comment and retrieve it through the site’s public WordPress REST API. With the secret key, the attacker may access the plugin’s import process and upload a malicious .wpress archive.

A crafted archive could include a malicious must-use WordPress plugin. Since must-use plugins load automatically, the malicious code can execute when a visitor or administrator opens a page.

This can grant the attacker remote code execution on the server and enable a full site compromise, including deploying a webshell, stealing data, or installing additional malware.

The exploit requires an administrator to perform an export followed by an import after the malicious trackbacks have been planted. Although this adds an interaction requirement, backup and restore operations are routine tasks for many WordPress administrators.

Wordfence deployed a firewall rule for Premium, Care, and Response users on August 16, 2026. Free Wordfence users are scheduled to receive the protection on September 15, 2026. ServMask acknowledged the report on August 17 and released version 7.110 on August 20.

Website owners using All-in-One WP Migration and Backup should update immediately, turn off unnecessary trackbacks, review suspicious comments, and verify that no unauthorized plugins or administrator accounts have been added.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.

The post WordPress Plugin Flaw Exposes 5 Million Sites to SQL Injection Attacks appeared first on Cyber Security News.

WordPress has launched a new security effort that uses artificial intelligence to identify vulnerabilities in its core software before attackers can abuse them.

The initiative comes as the project receives an increasing number of security reports, driven in part by rapid improvements in AI tools for code analysis and vulnerability research. Over the past year, WordPress said incoming vulnerability reports have increased substantially across its ecosystem.

AI models are making it easier for security researchers to inspect large codebases, trace potentially unsafe data flows, and flag risky programming patterns that could otherwise be missed during manual reviews.

The increase in reports is positive for WordPress security, but it also creates a major operational challenge. Every submission must be reviewed, reproduced, validated, prioritized, fixed, tested, and released.

WordPress Using AI to Find Security Flaws

A report may identify a real vulnerability, a configuration-specific issue, a duplicate finding, or a false positive. The WordPress security team must separate urgent flaws from lower-risk issues while ensuring that security patches do not break millions of websites.

The project discussed the issue during its security team meeting at WordCamp US and has now introduced the Core Security Initiative.

The program is built around three priorities: improving the security release process, reducing the backlog of open reports, and using AI-assisted tools to discover vulnerabilities earlier.

The first area focuses on making security releases more predictable. WordPress plans to strengthen automation and end-to-end testing around security updates so fixes can be delivered reliably.

Better testing is especially important for a platform with a large ecosystem of themes, plugins, hosting environments, and custom deployments. A patch must close the vulnerability without causing unexpected failures for site owners.

The second priority is reducing the queue of unresolved reports and known issues. WordPress is adding team members and volunteers to help review findings, confirm impact, and move valid issues through the remediation process. The stated goal is to reduce the number of open security findings to zero.

The third pillar, described as “Crush vulnerabilities with AI,” is the most notable part of the effort. WordPress intends to use AI-assisted scanning and analysis tools to proactively identify security weaknesses rather than waiting for an external researcher or attacker to discover them first.

These tools can help reviewers search for patterns linked to cross-site scripting, privilege escalation, insecure file handling, server-side request forgery, and other common web application risks. However, AI will not replace human security researchers.

Automated tools can identify suspicious code, but expert reviewers are still needed to verify whether a flaw is exploitable, determine its severity, create a safe patch, and test the fix.

WordPress said its AI work will complement, not replace, responsible disclosure reports from the security community. Recent WordPress releases show why faster discovery matters.

Version 7.0.3 addressed multiple security issues, including cross-site scripting, privilege escalation, server-side request forgery, information disclosure, and CSS injection flaws.

Version 7.0.4 later fixed an authenticated remote code execution issue involving malicious file uploads on sites using Imagick and Ghostscript.

WordPress core vulnerability researchers are encouraged to continue reporting findings through the project’s HackerOne program and to follow its reporting guidelines.

For website administrators, the message remains simple: apply WordPress security updates promptly, maintain tested backups, and keep plugins and themes up to date.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post WordPress Is Using AI to Find Security Flaws Before Hackers Can Exploit Them appeared first on Cyber Security News.

A critical vulnerability in the TranslatePress WordPress plugin could allow unauthenticated attackers to hijack administrator accounts and fully compromise affected websites.

The flaw, tracked as CVE-2026-19632, affects TranslatePress versions up to 3.3.1 and has been fixed in version 3.3.2. TranslatePress is a multilingual WordPress plugin with more than 400,000 active installations.

Wordfence assigned the vulnerability a CVSS score of 9.8, classifying it as critical. Security researcher momopon1415 responsibly reported the issue through the Wordfence Bug Bounty Program and received a $975 reward.

The vulnerability stems from the way TranslatePress processes password reset emails and saves translatable strings. The plugin can translate outgoing WordPress emails by intercepting the wp_mail() function.

When an administrator requests a password reset, WordPress generates an email containing a reset URL with a plaintext reset key and login parameters.

Under specific conditions, TranslatePress stores this sensitive reset URL in a secondary-language translation dictionary table. Automatic string saving must be enabled, which is the default setting.

In addition, the targeted administrator’s profile language must be configured to use a published secondary language rather than the website’s default language.

Researchers found that attackers could retrieve these saved dictionary entries through the plugin’s publicly accessible trp_get_translations_regular AJAX action.

The endpoint accepts attacker-supplied string identifiers and returns matching translation records. This could enable an unauthenticated attacker to enumerate translation data and locate a stored password reset URL.

TranslatePress WordPress Plugin Vulnerability

An attacker who knows an administrator’s username or email address could trigger a password reset request, extract the exposed reset link from the translation dictionary, set a new password, and log in as the administrator. Successful exploitation would give the attacker complete control over the WordPress site.

With administrator access, threat actors could create new privileged accounts, install malicious plugins or backdoored themes, alter website content, steal sensitive information, or use the compromised site to distribute malware.

The issue therefore poses a serious risk to businesses, publishers, e-commerce stores, and organizations that use TranslatePress.
The flaw does not affect every TranslatePress deployment in the same way.

The password reset URL is only exposed when the targeted administrator uses a published secondary-language profile locale. Administrators whose accounts use the site’s default language do not have their password reset emails processed through the affected secondary-language translation workflow.

Wordfence received the report on August 11, 2026, disclosed the issue to TranslatePress developer Cozmoslabs on August 12, and confirmed that the vendor released TranslatePress version 3.3.2 on August 13.

Site owners should immediately update TranslatePress to version 3.3.2 or later. Administrators should also enable two-factor authentication or passkeys, limit administrator accounts, review user activity, and inspect installed plugins and themes for unauthorized changes.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post WordPress Plugin Vulnerability Exposes 400,000 Sites to Account Takeover Attacks appeared first on Cyber Security News.

A critical vulnerability tracked as CVE-2026-19598 in the Everest Forms WordPress plugin has exposed more than 100,000 websites to complete site takeover attacks.

The flaw has a CVSS severity score of 9.8. It can allow unauthenticated attackers to upload malicious files, execute code remotely, and potentially gain full control of affected WordPress sites.

The vulnerability detailed by Wordfence affects Everest Forms versions before 3.0.9.5. It exists in the plugin’s file-upload handling logic, specifically in the EVF_Form_Fields_Upload class.

Insufficient validation of file types and paths can enable attackers to upload arbitrary files, including PHP scripts that the web server may execute.

WordPress Plugin Vulnerability Exposed

An attacker does not need a valid WordPress account to exploit the issue. By targeting a vulnerable form-upload feature with specially crafted requests, a threat actor could place a malicious PHP web shell on the server.

A web shell provides attackers with a remote interface to run commands, browse files, steal databases, modify site content, or install additional malware.

The impact can extend beyond defacing a website. Attackers with remote code execution can access the WordPress configuration file, extract database credentials, create administrator accounts, modify themes and plugins, and insert malicious JavaScript into visitor-facing pages.

This can turn a compromised website into a platform for phishing, malware delivery, SEO spam, credential theft, or attacks against site visitors.

The issue may also enable arbitrary file deletion. Attackers could remove important WordPress files, including wp-config.php, which stores database connection details.

Deleting this file may place a WordPress instance into installation mode, creating another path for attackers to connect the site to an attacker-controlled database and take ownership of the environment, reads the Wordfence report.

Website administrators should immediately update Everest Forms to version 3.0.9.5 or later. Sites that cannot be patched quickly should temporarily turn off the plugin, especially if it uses public file-upload forms.

Administrators should also investigate for signs of compromise. Security teams should review WordPress administrator accounts for unauthorized users, inspect upload directories for recently created PHP files, and examine web logs for suspicious requests targeting Everest Forms upload endpoints.

Newly modified plugin or theme files, obfuscated PHP code, unknown scheduled tasks, and unexpected outbound connections should be treated as potential indicators of compromise.

If compromise is suspected, organizations should rotate WordPress, database, hosting-panel, FTP, SSH, and API credentials. They should restore affected files from a known-good backup, remove unauthorized administrator accounts, and perform a full review of plugins, themes, scheduled jobs, and server-side persistence mechanisms.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post WordPress Plugin Vulnerability Exposes 100,000 Sites to Complete Site Takeover Attacks appeared first on Cyber Security News.

A critical security flaw in the Elementor Pro WordPress plugin could allow unauthenticated attackers to upload malicious PHP files and execute code on vulnerable servers.

Tracked as CVE-2026-32475, the vulnerability affects Elementor Pro versions up to and including 4.2.1 and is fixed in version 4.2.2.

Elementor Pro is a premium extension for the Elementor page builder. Its Forms widget lets website owners create contact, job application, support, and document-submission forms. The vulnerable feature is the File Upload field that allows visitors to attach files.

The flaw exists because the plugin handles file validation and file storage in separate loops. Under normal conditions, Elementor Pro checks uploaded file extensions against an allowlist and a blocklist. Dangerous extensions such as .php, .phtml, .asp, and .exe should be rejected.

WordPress Plugin Vulnerability

However, the two loops treat empty upload entries differently. An attacker can submit multiple file parts for a single upload field, placing an empty file entry first and a malicious PHP file afterward.

The validation routine stops when it encounters the empty entry, meaning it never checks the PHP file. The file-processing routine skips the empty entry and continues saving the subsequent malicious file.

As a result, an attacker may be able to place a PHP payload inside the public Elementor forms upload directory. If the uploaded file is accessed via a browser, the web server could execute it, granting the attacker remote code execution with the web server’s permissions.

The attack does not require a WordPress account, credentials, or administrator interaction. The primary requirement is a publicly available Elementor Pro Form widget that includes a File Upload field.

Elementor stated that the multiple file upload option must also be enabled, and that option is disabled by default. Affected administrators should immediately update Elementor Pro to version 4.2.2 or later.

The updated release aligns file validation and processing behavior and adds stronger validation closer to the file-moving process. Updating alone is not enough for sites that may be exposed.

The issue was discovered by security researcher Tin Pham, also known as TF1T, and reported through Patchstack. Patchstack published mitigation rules for its customers while Elementor prepared and released the security update on August 19, 2026.

Administrators should inspect the wp-content/uploads/elementor/forms/ directory for unexpected PHP files or other executable content. Any suspicious files should be treated as possible indicators of compromise and investigated before removal.

Website owners should also review public upload forms, turn off unnecessary file-upload functionality, restrict accepted file types, and prevent PHP execution in WordPress upload directories.

Although no active exploitation had been publicly observed at the time of reporting, the flaw’s unauthenticated nature makes rapid patching essential.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Critical WordPress Plugin Vulnerability Exposes Sites to RCE Attacks appeared first on Cyber Security News.

A critical security flaw in the Forminator Forms WordPress plugin could allow unauthenticated attackers to upload malicious PHP files, potentially enabling them to take full control of vulnerable websites.

The issue, tracked as CVE-2026-15748, affects Forminator Forms versions 1.56.1 and earlier and carries a CVSS severity score of 9.8.

Forminator Forms is a widely used drag-and-drop plugin for building contact, payment, poll, quiz, and file-upload forms. With more than 600,000 active installations, the vulnerability poses a significant risk to WordPress administrators who have not yet applied the available update.

WordPress Plugin Vulnerability

The flaw was reported through the Wordfence bug bounty program by security researcher daroo, who received a $2,048 reward for the discovery.

Wordfence validated the report on July 14, 2026, disclosed the issue to the Forminator development team on the same day, and the vendor released a fix in Forminator Forms version 1.56.2 on July 31, 2026.

The flaw in Forminator’s file-upload handling lets attackers inject a forged upload configuration through the Select field in vulnerable published forms.

During processing, Forminator accepts attacker-controlled values such as the upload field name, field type, and file-handling settings. The malicious request can then cause the plugin to treat the forged data as a legitimate upload configuration.

The attack also bypasses the plugin’s dangerous file-extension filtering. Forminator attempts to block PHP and other executable file types using a blocklist.

However, the filtering uses exact matching against file-extension keys. Researchers found that an attacker could use the pattern ph(p) instead of the blocked php extension.

WordPress still interprets ph(p) as matching a .php file extension, while Forminator’s blocklist fails to remove it. By combining the forged configuration with a MIME type such as text/x-php, an attacker may upload a PHP payload that passes validation checks.

Uploaded files are normally placed in a directory protected by an .htaccess rule that prevents PHP execution. However, sites that use a custom file-upload storage location may not receive that protection under certain conditions.

If the uploaded PHP file is stored in an executable web-accessible path, an attacker could directly access it and run arbitrary commands on the server.

Successful exploitation could lead to remote code execution, webshell deployment, theft of WordPress credentials, database access, malware installation, or complete site compromise. Site owners should immediately update Forminator Forms to version 1.56.2 or later.

Administrators should also review existing form configurations, inspect upload directories for suspicious PHP files, and verify that uploaded files cannot execute as server-side code.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.

The post Critical WordPress Plugin Vulnerability Exposes 600,000 Sites to File Upload Attacks appeared first on Cyber Security News.