A sophisticated cyber attack campaign targeting security researchers and penetration testers has resulted in the theft of over 390,000 credentials through a fake WordPress publishing tool on GitHub. The operation, attributed to threat actor MUT-1244, used trojanized repositories and phishi...
A critical vulnerability (CVE-2024-11972, CVSS 9.8) in the Hunk Companion WordPress plugin affects over 10,000 sites, allowing attackers to install malicious plugins and execute remote code. The flaw enables multiple attack vectors including RCE, SQL injection, and XSS. Discovered alongsid...
Critical vulnerability in Hunk Companion WordPress plugin (CVE-2024-11972) affects 10,000+ sites, allowing hackers to install malicious plugins and execute remote code. The flaw enables unauthorized admin access, SQL injection, and XSS attacks. Users must update to version 1.9.0 immediatel...
Critical security vulnerability in WPForms WordPress plugin (versions 1.8.4-1.9.2.1) allows unauthorized users to process Stripe refunds and cancel subscriptions. Affecting over 6 million websites, this flaw stems from improper authentication checks. The issue has been patched in version 1...
Two critical security flaws have been identified in the CleanTalk Spam Protection, Anti-Spam, and FireWall WordPress plugin, impacting over 200,000 websites. The vulnerabilities (CVE-2024-10542 and CVE-2024-10781) received a critical severity rating of 9.8/10 on the CVSS scale....
