WordPress 6.9, scheduled for release on December 2, 2025, is shipping with a new Abilities API that introduces a new system designed to make advanced AI-driven functionality possible for themes and ...

When users set up a brand new WordPress-powered website, they have long been greeted by a default, introductory post simply titled "Hello world!" But, now it's time for WordPress to say a farewell.

Attackers have found a way to escalate the benign WordPress REST API flaw and use it to gain full access to a victim's server by installing a hidden backdoor. On January 26, the WordPress team ...

Organizations running recent versions of WordPress are being asked to patch a newly detailed pre-authentication remote code execution (RCE) vulnerability affecting the platform’s built-in REST Batch ...

This post was sponsored by 10Web. The opinions expressed in this article are the sponsor’s own. Not long ago, building a website meant a discovery call, a proposal, a sitemap, and a few weeks of back ...

The WP2Shell vulnerability chain affects over 500 million sites. How it was discovered says more about the future of cybersecurity than the bug itself. The post The $25 AI Exploit That Exposed A ...

BdThemes supply chain attack poisoned JSON API exploiting XSS vulnerability to create rogue WordPress admin accounts and install webshells.

Une seule requête adressée à l’API REST de WordPress peut enchaîner un contournement d’autorisation, une lecture progressive ...

Eine kritische SQL-Injection-Lücke (CVE-2026-60137) hat einen CVSS-Wert von 9,1/10 und kann durch Angreifer aus der Ferne ausgenutzt werden. Die Lücke betrifft den author__not_in-Parameter von ...