AEU Hosting Blog
Latest articles
WordPress CVE-2026-87902 attacks reach code execution
WordPress CVE-2026-87902 is under active exploitation, with probes progressing to attempts to write PHP files to disk.
WordPress 7.1.2 fixes critical template file flaw
WordPress 7.1.2 patches a critical unauthenticated file inclusion flaw affecting Core versions 4.7.0 through 7.1.1.
WordPress 7.1.1 fixes unauthenticated stored XSS
WordPress 7.1.1 patches a stored XSS flaw in comments, plus ten other security issues affecting Core and older branches.
WordPress bots need a measured response, not a blanket ban
WordPress bots can slow sites, waste resources or help search visibility, so owners need a plan to allow, challenge or block traffic.
AI agent guardrails for safer WordPress updates
AI agent guardrails can stop automated WordPress work from reaching production without staging, backups, limited access and human review.
Public key cryptography faces questions over AI progress
Public key cryptography underpins secure web payments; Wordfence warns AI mathematics could challenge it, but reports no demonstrated encryption break.
WordPress upload flaw lets attackers plant executable files
WordPress sites using vulnerable Bricksforge versions face active attacks that can run malicious code without a login; version 3.1.8.10 fixes the flaw.
WordPress: 52 of 501 disclosed flaws remain unpatched
WordPress disclosures covered 501 flaws in plugins and themes, Wordfence reports, with 52 unpatched and 20 rated critical, making update checks essential.
WordPress fixes theme-install flaw that enabled takeover
WordPress 7.1.1 fixes Click2Shell, an attack chain that could turn an administrator's interaction with a malicious link into server-side code execution.
Unmanaged Third-Party Scripts: A Security Blind Spot
Third-party tags, pixels and embeds can read page data, change what visitors see, and enable payment card skimming if compromised, requiring tighter oversight.
WordPress Staging Sites Must Be Secured Too
A staging copy of your WordPress site can expose admin accounts, customer data and API keys. Here is how to lock it down.
Sucuri Account Logins Move to New Authentication Platform Aug 10
Sucuri starts migrating customer logins to sso.sucuri.net on August 10, 2026; passwords and two-factor authentication stay unchanged, and old links redirect aut…
WordPress 7.1.3 Fixes Comment XSS and Private Post Leaks
WordPress 7.1.3 patches seven security flaws, including a private-post comment leak and a stored XSS triggered by a moderator clicking a malicious pending-comme…
WordPress XSS Campaign Installs Hidden Admin Accounts
A stored XSS campaign abuses Ninja Forms and WPC Product Bundles to install a hidden admin account and backdoor in WordPress sites.
Elementor CSRF Flaw Turns a Clicked Link Into an Admin Account
Elementor 4.3.0 and 4.3.1 let one link opened by an admin perform any REST API action, including creating an administrator. Fixed in 4.3.2.
WordPress Vulnerabilities Drop 24% in Q2 as Attacks Surge
Wordfence's Q2 2026 report shows 2,073 WordPress vulnerabilities disclosed, a 24% drop, but high-risk flaws and attack volume jumped sharply.
260 WordPress Plugin Vulnerabilities Found, 38 Unpatched
Wordfence logged 260 vulnerabilities across 207 WordPress plugins last week; most are patched, but 38 remain unpatched and need immediate site owner action.
Wordfence 9 adds free passkeys for WordPress login
Wordfence 9 gives WordPress site owners a free passkey option that replaces passwords with one-click, fingerprint or face sign-in and makes phishing harder.
Self-healing WordPress malware hides in database and RAM
Sucuri documented SC, a WordPress backdoor that rebuilds itself from eight places, including the database and shared memory.
WordPress Security Plugins: Pick the Layers That Matter
Sucuri explains what WordPress security plugins actually do, their limits, and why layering hardening, firewall, scanning, and backups is essential.
AI finds hidden flaws in rarely-updated WordPress plugins
AI is rapidly finding unreported flaws in small WordPress plugins; a researcher's isolated lab turned suspicious code into verified vulnerabilities.
Wordfence: 319 WordPress Plugin Vulnerabilities in a Week
Wordfence recorded 319 vulnerabilities across 222 WordPress plugins in late September; 13 remain unpatched, including a core local file inclusion flaw.
Wordfence June Bug Bounty: 1,066 Reports, $42,553 Paid
Wordfence's June 2026 bug bounty program received 1,066 vulnerability submissions and paid $42,553, including critical flaws in Everest Forms Pro, Burst Statist…
362 WordPress Plugin Vulnerabilities Disclosed Last Week
Wordfence added 362 flaws across 247 plugins and 4 themes, including an unauthenticated stored XSS bug in WordPress core 7.1 and 45 unpatched issues.
WordPress 7.1.2 patches critical path traversal vulnerability
WordPress 7.1.2 and backports fix a critical flaw that lets unauthenticated attackers include a local PHP file, potentially leading to site takeover. Update now…
Stealthy WordPress malware hides admin via must-use plugin
A stealthy WordPress must-use plugin hides a rogue admin account, stores plaintext passwords, self-restores and spreads across shared hosting, Wordfence reports…
Critical libheif Flaw Lets HEIC Images Run Code on Servers
A critical bug in the libheif image library can let crafted HEIC uploads read files or run code on vulnerable WordPress servers.