WordPress has released version 7.1.4 to address 22 vulnerabilities, including issues related to remote code execution, stored cross-site scripting, information disclosure, and authorization weaknesses. This security update was published on October 28, 2026, and it is recommended that users upgrade immediately. The fixes encompass core functionality, including content blocks, administrative screens, the Customizer, and the […]

The post WordPress 7.1.4 Security Update Patches 22 Vulnerabilities Affecting Millions of Websites appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

TRUST#GRAFT, a JavaScript-to-WordPress attack chain that never breaks WordPress authentication. Instead, it borrows the trust placed in an already logged-in administrator’s browser and uses that session to install a persistent PHP backdoor. Many administrators stay signed in to wp-admin in the same profile they use for everyday browsing. That habit gives attackers a usable foothold. […]

The post New TRUST#GRAFT Attack Tricks WordPress Admin Browsers Into Installing Malicious Plugins appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Attackers exploited compromised UpdraftCentral connection keys to send trusted remote-management commands to WordPress sites, ultimately installing malicious plugins that could provide unauthorized access to these websites. This incident followed unauthorized access to TeamUpdraft’s website on October 17-18, 2026. The company suspects attackers accessed its customer database, which contained UpdraftCentral connection keys and customer account information. […]

The post Hackers Exploit Compromised UpdraftCentral Keys to Install Malicious Plugins on WordPress Sites appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Rank Math has reported a security incident involving malware distributed through Rank Math PRO version 3.0.123. They warn that WordPress websites using this compromised plugin are at risk if administrators activated it. The company has removed the affected files and released a clean version, 3.0.124. Rank Math PRO Compromised The incident impacts a limited number […]

The post Rank Math PRO WordPress Plugin Compromised to Spread Malware and Steal Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Hackers can compromise vulnerable WordPress websites without stealing passwords by chaining two security flaws in the platform’s core. Disclosed in July 2026, the chain involves CVE-2026-63030 and CVE-2026-60137. Unlike attacks dependent on vulnerable extensions, WP2Shell affects default WordPress installations without requiring a third-party plugin. Public exploit code and observed exploitation have made unpatched deployments an […]

The post Hackers Can Take Over WordPress Websites Without a Password Using Two Security Flaws appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.