wordpress security

CISA’s decision on July 21, 2026, to add four vulnerabilities to its Known Exploited Vulnerabilities catalog is more than another routine patching notice. The update places an aging DD-WRT router flaw, a serious Langflow remote-code-execution issue, and two newly disclosed WordPress core...

A critical authentication-bypass vulnerability in miniOrange’s enterprise OAuth Single Sign-On plugin for WordPress can reportedly let an unauthenticated attacker obtain administrator-level access. Patchstack disclosed the flaw on July 9, 2026, and says every enterprise release through version...

Security Affairs published Round 582 of Pierluigi Paganini’s international newsletter on June 21, 2026, collecting a week of ransomware, malware, vulnerability, data-breach, and cyber-policy stories that together show how much of today’s security crisis has moved to the exposed edge of ordinary...

CVE-2026-8206 is a critical privilege-escalation flaw in the Kirki WordPress plugin, affecting versions 6.0.0 through 6.0.6, fixed in 6.0.7, and reported by BleepingComputer on June 2, 2026 as already being exploited to hijack administrator accounts. Site owners should update Kirki immediately...