pwned.coffeeUpdated 20 min ago

The menu

WordPress

Operational

Nothing about WordPress is on fire right now. We'd tell you. Probably.

0 spills in 2025 for WordPress

Not a single spill. Remarkable.

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Past orders

  1. highpatchedexploited WordPress Core Remote File Inclusion Vulnerability WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Added to CISA KEV on 2026-09-25 (federal deadline 2026-09-28). CVE-2026-879022 sources
  2. highpatchedexploited WordPress Core SQL Injection Vulnerability WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. Can be chained with CVE-2026-63030. Added to CISA KEV on 2026-07-21 (federal deadline 2026-08-04). CVE-2026-60137CVE-2026-630303 sources
  3. criticalpatchedexploited WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerability WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Added to CISA KEV on 2026-04-30 (federal deadline 2026-05-03). CVE-2026-419404 sources

More in Web & runtimes

Follow WordPress

RSS: /feed.xml?stack=wordpress. JSON: /incidents.json?stack=wordpress. Or add it to your usual for delivery.