Loading story…
Attackers targeted multiple widely used WordPress plugins with critical flaws that enabled site takeover, malware deployment, and remote code execution. The most prominent issue, CVE-2024-27956 in WP-Automatic before version 3.9.2.0, was exploited through SQL injection to bypass authentication, create rogue administrator accounts, upload malicious files, and fully compromise websites; defenders were told to watch for suspicious admin usernames beginning with xtw, renamed WP-Automatic files, and known malicious file hashes. CSIRT.SK also reported more than 5.5 million exploitation attempts across several WordPress plugin vulnerabilities, including CVE-2024-27956, CVE-2024-2876, CVE-2024-2417, and CVE-2024-28890.
Separate advisories warned that Forminator versions earlier than 1.29.3 contained a critical unrestricted file upload flaw, CVE-2024-28890, that could let remote attackers execute code on the server, alongside CVE-2024-31077 and CVE-2024-31857, which exposed sites to SQL injection and cross-site scripting. CSIRT.SK also flagged Poll Maker before version 3.4 for CVE-2024-32514, an arbitrary file upload vulnerability that could lead to remote code execution. The combined disclosures showed active attacker focus on vulnerable WordPress plugins as an initial access path, prompting urgent patching and compromise checks across exposed sites.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK warned about critical vulnerabilities in the WP-Automatic and Poll Maker WordPress plugins, including CVE-2024-27956 and CVE-2024-32514. The advisory said more than 5.5 million active exploitation attempts had been observed across several plugin vulnerabilities and shared indicators of compromise.
WPScan published a report on a new malware campaign targeting the WP-Automatic plugin. The reference establishes public reporting of the campaign but does not provide an explicit event date beyond the publication itself.
CSIRT.SK reported three vulnerabilities in the WordPress Forminator plugin, including critical CVE-2024-28890 and high-severity CVE-2024-31077 and CVE-2024-31857. The notice said versions earlier than 1.29.3 were affected and recommended upgrading to 1.29.3 or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcewpscan.com
Open sourcecsirt.sk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple **WordPress plugins** were flagged for severe vulnerabilities that could let attackers take over sites through unauthenticated file upload, SQL injection, arbitrary file deletion, and authorization bypass. References point to issues in plugins including **WP Duplicate**, **Ninja Forms File Upload**, **Ultimate Member**, **Product Addons for WooCommerce**, **CleanTalk Spam Protect**, **Ally**, **Perfmatters**, and **Kali Forms**, alongside identifiers such as **`CVE-2024-48930`**, **`CVE-2025-13192`**, and **`CVE-2026-1104`**. Several flaws were described as allowing arbitrary plugin installation, malicious file upload, or direct database manipulation, creating a path to remote code execution and full site compromise. Wordfence reports indicate the exposure spans **hundreds of thousands of WordPress sites**, with some bugs already under **active exploitation**. The most serious cases include an unauthenticated SQL injection flaw in the **Ally** plugin affecting roughly **400,000 sites**, an arbitrary file deletion issue in **Perfmatters** affecting about **200,000 sites**, and active attacks targeting a critical flaw in **Kali Forms**. Taken together, the disclosures show a broad wave of high-impact plugin security failures that increase the risk of website defacement, malware deployment, data theft, and administrator-level compromise across the WordPress ecosystem.
Jul 12, 2026
Two high-severity vulnerabilities have been disclosed in widely deployed WordPress plugins, exposing internet-facing sites to **unauthenticated compromise**. `CVE-2026-3584` affects **Kali Forms** through version `2.4.9` and allows **remote code execution** because user-controlled input can be mapped into internal placeholder storage and later invoked via `call_user_func` in the `form_process` path. The issue is classified as `CWE-94` and carries a `CVSS 3.1` score with the vector `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`, indicating critical impact on confidentiality, integrity, and availability. A second flaw, `CVE-2026-4038`, affects **Aimogen Pro** through version `2.7.5` and enables **unauthenticated privilege escalation** through an arbitrary function call in `aiomatic_call_ai_function_realtime` caused by a missing capability check. According to the disclosure, attackers can invoke WordPress functions such as `update_option` to change the default registration role to administrator and enable user registration, effectively creating a path to full site takeover. The vulnerability is tracked as `CWE-862` and was likewise rated with a high-impact `CVSS 3.1` vector of `AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`.
Jun 29, 2026
Multiple high-severity flaws in WordPress plugins exposed sites to account takeover and, in one case, possible remote code execution. In **Users Manager PN**, tracked as `CVE-2026-4003`, a missing authorization check in the `userspn_ajax_nopriv_server()` handler let unauthenticated attackers overwrite arbitrary user metadata through the `userspn_form_save` AJAX action. Because the required `userspn-nonce` was reportedly exposed on public pages, attackers could abuse the bug with a single crafted request to modify profiles and potentially seize control of administrator accounts. The issue affected versions through `1.1.15` and was reportedly fixed in `1.1.20`. Two additional vulnerabilities were disclosed in **WP Captcha PRO** affecting versions through `5.38`. `CVE-2026-5415` allowed **Subscriber-level users or higher** to generate temporary login links for arbitrary accounts because the `ajax_run_tool()` AJAX handler checked only a nonce and not user capabilities, enabling authentication bypass and administrator takeover. Separately, `CVE-2026-5411` allowed authenticated low-privilege users to upload attacker-controlled files by poisoning license metadata and abusing `sync_cloud_protection()` to download and extract content into a web-accessible uploads directory; if PHP execution was possible and `allow_url_fopen` was enabled for remote retrieval, the flaw could be escalated to **remote code execution** via a webshell.
Jun 29, 2026