WordPress
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Phishing reported by Cyber Security NewsFake ChatGPT Plus billing emails steal card details and one-time passwords
- Vulnerability reported by GBHackersWordPress core RCE flaw sees over 58,000 blocked exploit attempts
- Vulnerability reported by Cyber Security NewsOver 60,000 blocked attacks target WordPress core code execution flaw
- Vulnerability reported by SecurityWeekPHP2Shell attacks root Palo Alto firewalls but fail against WordPress
Recent news
Fake ChatGPT Plus billing emails steal card details and one-time passwords
Fortra researchers documented a phishing campaign impersonating OpenAI billing notices that lead to fake checkout pages on short-lived WordPress sites. The pages capture card details, then hold victims on an indefinite spinner while a human operator, polling a dashboard, decides whether to request a one-time password, show an error or end the session. Fortra observed phishing only, with no malware delivery.
WordPress core RCE flaw sees over 58,000 blocked exploit attempts
Attackers are targeting an unauthenticated remote code execution vulnerability in WordPress Core, with a brief exposure window during software updates. Wordfence recorded 58,693 blocked attacks within 24 hours, though these are attempts rather than confirmed compromises. WordPress 7.1.4, released on 28 October 2026, fixes 22 security vulnerabilities.
Over 60,000 blocked attacks target WordPress core code execution flaw
WordPress 7.1.4, released on 28 October 2026, fixes 22 vulnerabilities, including a race-condition remote code execution flaw in the core upgrade process. Wordfence logged 60,471 blocked exploitation attempts over 24 hours, though these are attempts rather than confirmed compromises. Administrators should update, verify that the update completed, and consider restricting public access to wp-content/upgrade/.
PHP2Shell attacks root Palo Alto firewalls but fail against WordPress
Critical PHP vulnerabilities, referred to as PHP2Shell, have been targeted in attacks for over a week. The attacks have gained root access on Palo Alto firewalls but failed against WordPress. Around 22.6 million exposed instances are potentially affected.