WordPress

Reported Context (9)

WordPress core’s upgrade-window RCE lands in KEV (CVE-2026-119977) Weekly Security Roundup: Binance’s $6.4B Theft, CrowdStrike Acquisitions and Malicious Claude Code Builds
Public Exploits Shrink the Window: Splunk’s flaw reached the KEV catalog eight days after disclosure, six days after a public proof-of-concept (PoC) appeared, and WordPress sites were attacked on the day the fix shipped. 10 RCE Vulnerabilities Defenders Should Prioritize, Including Exploited Zero-Days
WordPress 7.1.2 fixes critical unauthenticated path traversal vulnerability (CVE-2026-87902) Week in review: Gyazo breach exposes 23.6M user records, TASK#STOMP steals documents
WordPress 7.1.1 fixes 11 vulnerabilities, including Click2Shell and Comment2Shell, two vulnerabilities that researchers demonstrated can be leveraged to execute attacker-supplied PHP code on a WordPress server. WordPress 7.1.1 Fixes Click2Shell and Comment2Shell Code-Execution Paths
WordPress released version 7.1.2 to fix CVE-2026-87902, a critical path traversal flaw in get_page_template() that could let an unauthenticated attacker load an arbitrary PHP file from outside the active theme directory. WordPress 7.1.2 Patches Critical Unauthenticated Path Traversal Flaw

CVE (100)

Malware (10)

People (12)

Threat Actors (12)

MITRE ATT&CK (6)

Vendors (39)

Products (93)

Tools (6)

Industries (4)

Countries (11)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.