AI
How did exposed logs reveal CyberXero's AI campaign stealing 628k records?
Researchers attribute a dual-pronged campaign using Claude Code and Cobalt Strike to steal data from Ukraine and global WordPress sites.
WordPress
Everything Sandbox Dispatch has reported about WordPress: 6 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
Why do subscribers pose a CVSS 9.9 threat to CodeBard Help Desk via CVE-2026-62024?
The NVD rates this arbitrary file upload flaw in CodeBard Help Desk versions up to 1.1.2 as critical due to the low privilege required for exploitation.
Vulnerabilities
How Does CVE-2026-62045 Endanger Booklovers WordPress Sites With Untrusted Data Deserialization?
A critical CVE-2026-62045 flaw in the Booklovers WordPress theme allows unauthenticated object injection through version 2.13.0, posing severe risks to site integrity.
Vulnerabilities
How can attackers seize full server control of your WordPress site with just one unauthenticated POST request?
A critical vulnerability in the 3D Product Configurator plugin lets attackers run server code without login credentials, posing severe risks to WordPress sites.
Vulnerabilities
How does Advanced IP Blocker flaw CVE-2026-104732 let attackers bypass 2FA to seize WordPress admin control?
A critical authentication bypass in the Advanced IP Blocker plugin allows unauthenticated attackers to brute-force 2FA codes and seize full admin control of WordPress sites.
Vulnerabilities
Avada Builder Critical Bypass Lets Attackers Destroy WordPress Sites
Unauthenticated users can trigger arbitrary hooks in Avada Builder 7.16.1, causing permanent content deletion and denial of service without a login.