Loading story…
Attackers actively exploited a critical zero-day in the Fancy Product Designer plugin for WordPress, including deployments tied to WooCommerce, by scanning for vulnerable sites and abusing a malicious file upload flaw to achieve remote code execution. The vulnerability allowed unauthenticated attackers to upload executable PHP files, giving them a path to fully compromise affected websites.
Researchers at Wordfence said the activity appeared focused on e-commerce sites, where intruders could steal order data containing customer personally identifiable information and expose merchants to potential PCI-DSS compliance issues. Wordfence observed exploitation beginning on January 30, 2021, and urged site owners to update to Fancy Product Designer version 4.6.9, which was released to address the issue.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
Wordfence observed active exploitation of a critical remote code execution vulnerability in the WordPress Fancy Product Designer plugin beginning on January 30, 2021. Attackers were scanning for vulnerable sites and abusing malicious file uploads to gain full control, with e-commerce stores appearing to be the primary targets.
A patched release, Fancy Product Designer version 4.6.9, was issued to fix the vulnerability. Users were urged to update immediately because the plugin lacked an automatic update mechanism and some configurations could remain exploitable even after deactivation.
Wordfence publicly disclosed the Fancy Product Designer zero-day while it was still under active attack and before a patch was available. The company withheld some technical details but shared indicators of compromise, including attacker IP addresses, to help defenders detect intrusions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-27540**, a critical CVSS 9.8 unauthenticated arbitrary-file-upload flaw in the WordPress/WooCommerce Wholesale Lead Capture plugin. Versions through `2.0.3.1` trust attacker-controlled file-type settings in the public wholesale-registration form, allowing attackers to upload executable PHP files without logging in and gain remote code execution on the hosting server. Exploitation has reportedly persisted for months, and Wordfence has blocked more than 100,000 attempts against roughly 6,000 active installations. Affected operators should upgrade to version `2.0.3.2` and investigate for PHP webshells, unauthorized administrator accounts, altered checkout content, persistence mechanisms, suspicious outbound connections, and related log activity.
Sep 15, 2026
Attackers are actively exploiting **CVE-2026-3300**, a critical unauthenticated remote code execution flaw in the **Everest Forms Pro** WordPress plugin, to fully compromise vulnerable sites. The bug affects versions through **1.9.12** and was fixed in **1.9.13**. It stems from the plugin’s Complex Calculation feature, where user-controlled input in `process_filter()` is concatenated into PHP code and executed with `eval()`, allowing arbitrary PHP injection through crafted form submissions, often via the `/wp-admin/admin-ajax.php` endpoint. Wordfence reported exploitation beginning on April 13 and escalating into mass attacks, with more than **29,300** exploit attempts blocked overall and over **17,900** on May 16 alone. A recurring payload creates a rogue administrator account named **`diksimarina`**, giving attackers persistent access to upload webshells, install backdoors, alter site content, and potentially pivot deeper into the hosting environment. Defenders are being urged to upgrade immediately to **1.9.13 or later**, audit WordPress administrator accounts for unauthorized users, and review logs for suspicious requests and known malicious IP activity.
Jun 29, 2026
Multiple **WordPress plugins** were flagged for severe vulnerabilities that could let attackers take over sites through unauthenticated file upload, SQL injection, arbitrary file deletion, and authorization bypass. References point to issues in plugins including **WP Duplicate**, **Ninja Forms File Upload**, **Ultimate Member**, **Product Addons for WooCommerce**, **CleanTalk Spam Protect**, **Ally**, **Perfmatters**, and **Kali Forms**, alongside identifiers such as **`CVE-2024-48930`**, **`CVE-2025-13192`**, and **`CVE-2026-1104`**. Several flaws were described as allowing arbitrary plugin installation, malicious file upload, or direct database manipulation, creating a path to remote code execution and full site compromise. Wordfence reports indicate the exposure spans **hundreds of thousands of WordPress sites**, with some bugs already under **active exploitation**. The most serious cases include an unauthenticated SQL injection flaw in the **Ally** plugin affecting roughly **400,000 sites**, an arbitrary file deletion issue in **Perfmatters** affecting about **200,000 sites**, and active attacks targeting a critical flaw in **Kali Forms**. Taken together, the disclosures show a broad wave of high-impact plugin security failures that increase the risk of website defacement, malware deployment, data theft, and administrator-level compromise across the WordPress ecosystem.
Jul 12, 2026