WordPress MalCare WordPress Security plugin 5.16-6.62 - Unauthenticated Site Takeover via Connection Key Recovery vulnerability

Unauthenticated Site Takeover via Connection Key Recovery vulnerability discovered by Jakub Herman in WordPress Plugin MalCare Security versions 5.16-6.62...

CVE-2026-19718

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote...

CVE-2026-19718 BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote...

CVE-2026-19718

CVE-2026-19718 affects three WordPress plugins — BlogVault Backup & Staging , MalCare WordPress Security , and The WP Remote (versions 5.16–6.62) — where a weak pseudo-random number generator is used to create the connection key secret that binds a site to its remote management service. Unauthent...

EUVD-2026-66276

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote...

WordPress MalCare Security plugin <= 4.57 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability discovered by Lenon Leite in WordPress MalCare Security plugin versions = 4.57. Solution Update the WordPress MalCare Security plugin to the latest available version at least 4.58...

Critical Bug in WordPress Plugins Open Sites to Hacker Takeovers

UPDATE Security researchers are warning users of two WordPress plugins – made by Brainstorm Force – that they need to patch a “major” vulnerability that could allow hackers to gain administrative access to any website using the plugins. According to Brainstorm Force, it is only aware of one...

Flaw in Elementor and Beaver Addons Let Anyone Hack WordPress Sites

Attention WordPress users! Your website could easily get hacked if you are using "Ultimate Addons for Beaver Builder," or "Ultimate Addons for Elementor" and haven't recently updated them to the latest available versions. Security researchers have discovered a critical yet easy-to-exploit...

WordPress Ultimate Addons for Elementor plugin <= 1.20.0 - Authentication Bypass vulnerability

Authentication Bypass vulnerability found by MalCare in WordPress Ultimate Addons for Elementor plugin versions = 1.20.0. Solution Update the WordPress Ultimate Addons for Elementor plugin to the latest available version at least 1.20.1...

WAFW00F v1.0.0 - Detect All The Web Application Firewall!

WAFW00F identifies and fingerprints Web Application Firewall WAF products. How does it work? To do its magic, WAFW00F does the following: Sends a normal HTTP request and analyses the response; this identifies a number of WAF solutions. If that is not successful, it sends a number of potentially...