WordPress security articles, guides, and announcements.
WordPress 7.1.2 shipped on September 22, 2026, and it fixes exactly one thing: CVE-2026-87902, an unauthenticated path traversal in core's page-template resolution that can end in remote code executio...
Roughly 76% of newly observed malware now exhibits AI-driven polymorphism, regenerating itself in real time to dodge whatever scanned it last. That single number explains why so many WordPress sites g...
It's 9:14 on a Tuesday morning. You open your inbox and the second email stops you cold. The subject line reads "Urgent: Malware detected on yourdomain.com." The sender looks like your host. The logo...
Researchers disclosed more than 40 CVEs against Model Context Protocol implementations in 2026, roughly one every four days, spread across the Python, TypeScript, Java, and Rust SDKs. That's a brand n...
You search for your own website and see it: "This site may be hacked" right below your listing in Google. Or worse, a full red interstitial page warning visitors away before they even reach your site....
In 2025, researchers found 11,334 new vulnerabilities in the WordPress ecosystem, a 42% jump from the year before. Sucuri scanned 70.8 million websites and flagged over 1.1 million as infected. Wordfe...
Most WordPress site owners find out they have been hacked weeks or months after the initial breach. By then, the damage is done: search rankings have dropped, visitors are being redirected to spam sit...
Choosing a WordPress security scanner is confusing. There are dozens of options, ranging from free plugins to $500/year enterprise plans, and [what you actually pay depends on which layer of security...
A compromised blog is bad. A compromised WooCommerce store is a crisis. When a regular WordPress site gets hacked, you lose traffic and reputation. When a WooCommerce store gets hacked, you potential...
A blacklisted website loses traffic overnight. Google removes you from search results. Browsers show scary red warning pages. Email services reject messages from your domain. And most site owners have...
Your WordPress site is infected. Maybe your host suspended your account, [visitors are getting redirected to scam pages](/blog/signs-wordpress-site-hacked), or your security scanner found malicious co...