[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [QUIET] · [TECHNOLOGY]

9 clusters · 24 sources · 44 days · First seen · Last updated

Cybersecurity vulnerabilities in WordPress and Joomla

Overview

Cybersecurity experts and agencies, including CISA, have reported an increase in attacks targeting WordPress and Joomla websites. Vulnerabilities in the WordPress ecosystem have risen significantly, with data from Patchstack indicating approximately 11,334 new vulnerabilities discovered in 2025, a 42 percent increase from the prior year. Most of these flaws reside in plugins and themes rather than the core software.

Specific threats have been identified in the Astroid template framework and the JCE content editor, with risk scores reaching 10.0. A high-severity second-order SQL injection vulnerability, CVE-2026-19949, was identified in the All-in-One WP Migration and Backup plugin. While a patch was released in version 7.110, as of early September 2026, it was estimated that approximately 3.25 million installations were still running vulnerable versions. Additionally, a critical-severity vulnerability (CVE-2026-32475) in the Elementor Pro plugin allowed unauthenticated attackers to execute code via arbitrary file uploads. Although patched in version 4.2.2 on August 19, threat actors began exploiting the defect immediately.

In mid-September 2026, a supply chain attack involving the Admin Menu Editor Pro plugin compromised approximately 1,500 websites. Following the release of WordPress 7.1.2 on September 22, a critical unauthenticated path traversal vulnerability (CVE-2026-87902) was discovered in WordPress Core.

By October 2026, researchers identified a campaign exploiting stored cross-site scripting (XSS) vulnerabilities in the Ninja Forms (CVE-2026-94504) and WPC Product Bundles for WooCommerce (CVE-2026-93836) plugins. Attackers plant malicious JavaScript within form submissions or order data to hijack administrator sessions, allowing them to install backdoors, create rogue administrator accounts, and use backdated file timestamps to evade detection. Experts warn that simply updating these plugins may not be sufficient, as attackers may have already established persistence through hidden administrator accounts that do not appear in standard user lists.

Entities

WordPress · Patchstack · Uganda National CERT and Coordination Center · Elementor · CISA

Claims

What the coverage asserts, and how many sources carry each claim.

Timeline

  1. [TECHNOLOGY] 2 sources
    WordPress plugins exploited to create hidden administrators

    Attackers are exploiting WordPress plugins WPC Product Bundles and Ninja Forms to create hidden admin accounts and maintain persistent access to compromised websites.

  2. [TECHNOLOGY] 3 sources
    WordPress plugins Ninja Forms and WPC Product Bundles exploited by hackers

    Attackers are exploiting XSS vulnerabilities in Ninja Forms and WPC Product Bundles plugins to plant backdoors and rogue admin accounts on WordPress sites. Immediate updates are recommended.

  3. [TECHNOLOGY] 2 sources
    WordPress vulnerability exploited for remote code execution

    A critical WordPress path traversal vulnerability (CVE-2026-87902) is being actively exploited for remote code execution, prompting urgent update advisories from security firms and national CERTs.

  4. [TECHNOLOGY] 3 sources
    Citrix and Elementor face critical security vulnerabilities

    Citrix confirms multiple NetScaler vulnerabilities with active exploitation, while a critical CSRF flaw in the Elementor WordPress plugin puts up to two million sites at risk of admin account takeover.

  5. [TECHNOLOGY] 2 sources
    WordPress vulnerability highlights shrinking window between patch and exploit

    Cybersecurity experts warn of a collapsing window between software patches and exploitation, highlighted by a critical WordPress vulnerability and accelerating trends in known exploited flaws.

  6. [TECHNOLOGY] 3 sources
    Admin Menu Editor Pro plugin compromise affects 1,500 WordPress sites

    A malicious update for the Admin Menu Editor Pro WordPress plugin has compromised at least 1,500 sites via a web shell and hidden user accounts.

  7. [TECHNOLOGY] 3 sources
    Elementor Pro WordPress plugin vulnerability exploited by hackers

    A critical vulnerability (CVE-2026-32475) in the Elementor Pro WordPress plugin allows unauthenticated attackers to upload malicious PHP payloads and compromise websites.

  8. [TECHNOLOGY] 5 sources
    WordPress plugin flaw exposes millions of sites to takeover

    A critical SQL injection vulnerability in the All-in-One WP Migration and Backup plugin leaves millions of WordPress sites at risk of remote code execution and complete takeover.

  9. [TECHNOLOGY] 6 sources
    WordPress and Joomla websites face increased cyberattacks

    Cybercriminals are targeting WordPress and Joomla sites, exploiting critical vulnerabilities in plugins and themes. Patchstack reports a 42% increase in WordPress vulnerabilities in 2025.

Sources

adminmenueditor.com · b2k-media.de · blogspan.net · cert.ug · cinemagia.wordpress.com · cybernoz.com · dev.to · esecurityplanet.com · hrtechnologist.com · infoguerra.com.br · it-boltwise.de · it-daily.net · kevinleary.net · kulturegeek.fr · minutodaseguranca.blog.br · news.mynavi.jp · newsonline24.net · pcauthority.com.au · presse-board.de · pressnetwork.de · rbfirehose.com · reporterbox.de · schlaunews.de · skiline.cc

This summary has been updated 8 times: see revision history