WordPress security articles, guides, and announcements.
On September 1, 2026, LiteSpeed shipped version 7.9.1 of LiteSpeed Cache to close CVE-2026-84761, a server-side request forgery bug carrying a CVSS score of 7.2. Days later, Hide My WP Ghost, a plugin...
In May 2026, the User Verification plugin for WordPress let an attacker log in as any verified user, including an administrator, by submitting `true` as their one-time passcode. No password guessing,...
Every few weeks a critical vulnerability lands in a WordPress plugin and the write-up includes the same phrase: "the nonce check passed, but". The latest example is [CVE-2026-1492](/blog/user-registra...