Loading story…
Slow mobile WordPress sites introduce significant security vulnerabilities that can be exploited by attackers. When mobile pages load slowly, administrators may delay critical updates, and security logs become harder to interpret due to increased noise, providing attackers with more opportunities to attempt brute-force and credential stuffing attacks. High Time to First Byte (TTFB) and inconsistent Interaction to Next Paint (INP) metrics can cause session confusion and timeouts, which attackers exploit to increase the number of password guesses before detection mechanisms are triggered. Sluggish performance also leads to deferred patching, making sites more susceptible to breaches through outdated plugins, themes, or PHP versions. Attackers can abuse XML-RPC and REST APIs during periods of backend stress, increasing the risk of enumeration and token probing. The use of third-party scripts, especially on login and checkout pages, further expands the attack surface, as these scripts can be compromised or injected with malicious code. Security best practices for WordPress sites include enforcing two-factor authentication or passkeys, disabling unused XML-RPC functionality, applying rate limiting and web application firewall (WAF) rules, minimizing plugin usage, and implementing strict security headers such as HSTS, CSP, and Subresource Integrity.
In parallel, payment iframes, commonly used to secure credit card transactions on WordPress and other platforms, are being actively targeted by sophisticated attackers. The Stripe iframe skimmer campaign exemplifies this threat, where attackers inject malicious JavaScript into vulnerable WordPress sites to overlay fake payment forms that mimic legitimate Stripe iframes. These overlays are pixel-perfect, making them indistinguishable to users and allowing attackers to steal credit card data without detection. The campaign has already compromised dozens of merchants by exploiting deprecated Stripe APIs to validate stolen cards in real time. Traditional defenses like Content Security Policy (CSP) and X-Frame-Options are proving inadequate against these modern attack vectors, which also include postMessage spoofing and CSS-based data exfiltration. The widespread use of third-party scripts, such as Google Tag Manager, further increases the risk, as 18% of websites run these tools directly on payment pages. The new PCI DSS 4.0.1 standards now require merchants to secure the entire page, not just the iframe, emphasizing the need for comprehensive, real-time monitoring and layered security controls.
Both slow mobile performance and insecure integration of payment iframes on WordPress sites create overlapping risks that attackers are increasingly exploiting. Defenders must treat performance optimization as a core security measure and adopt a holistic approach to securing both the application stack and embedded payment components. Failure to address these issues can result in undetected breaches, financial losses, and regulatory non-compliance. Organizations are urged to regularly audit their WordPress environments, minimize third-party dependencies, and stay current with evolving security standards and attack techniques. The convergence of performance and security concerns highlights the need for cross-functional collaboration between IT, security, and development teams to protect sensitive data and maintain customer trust.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
SecuritySenses published an article arguing that slow mobile WordPress sites can introduce hidden security risks, framing site performance issues as a security concern for WordPress operators.
A report published by The Hacker News described iframe-related security blind spots as a factor fueling payment skimmer attacks, surfacing technical risk details around web payment security.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of sophisticated cyberattacks have targeted online payment systems and e-commerce users through phishing emails, malicious browser extensions, and large-scale web skimming operations. One campaign impersonated WordPress.com, sending convincing domain renewal emails that redirected victims to a fake payment portal designed to steal credit card details and 3-D Secure OTPs, with exfiltration occurring via Telegram. Another operation involved over 50 malicious scripts injected into checkout and account creation flows on e-commerce sites, using modular payloads tailored for specific payment processors like Stripe, PayPal, and Mollie, and leveraging fake domains to evade detection. In parallel, threat actors have deployed malicious browser extensions across Chrome, Edge, and Firefox, impacting millions of users by hijacking search queries, stealing data, and committing affiliate fraud. These extensions often remain dormant for extended periods before being weaponized through updates, further complicating detection. Collectively, these campaigns demonstrate a significant evolution in cybercriminal tactics, blending phishing, web skimming, and browser-based attacks to compromise sensitive financial and personal information at scale.
Jun 29, 2026
Multiple **WordPress plugins** were flagged for severe vulnerabilities that could let attackers take over sites through unauthenticated file upload, SQL injection, arbitrary file deletion, and authorization bypass. References point to issues in plugins including **WP Duplicate**, **Ninja Forms File Upload**, **Ultimate Member**, **Product Addons for WooCommerce**, **CleanTalk Spam Protect**, **Ally**, **Perfmatters**, and **Kali Forms**, alongside identifiers such as **`CVE-2024-48930`**, **`CVE-2025-13192`**, and **`CVE-2026-1104`**. Several flaws were described as allowing arbitrary plugin installation, malicious file upload, or direct database manipulation, creating a path to remote code execution and full site compromise. Wordfence reports indicate the exposure spans **hundreds of thousands of WordPress sites**, with some bugs already under **active exploitation**. The most serious cases include an unauthenticated SQL injection flaw in the **Ally** plugin affecting roughly **400,000 sites**, an arbitrary file deletion issue in **Perfmatters** affecting about **200,000 sites**, and active attacks targeting a critical flaw in **Kali Forms**. Taken together, the disclosures show a broad wave of high-impact plugin security failures that increase the risk of website defacement, malware deployment, data theft, and administrator-level compromise across the WordPress ecosystem.
Jul 12, 2026
A critical security vulnerability, tracked as CVE-2025-6388, has been identified in the Spirit Framework plugin for WordPress, affecting all versions up to and including 1.2.14. The flaw is rooted in the custom_actions() function, which fails to properly validate user identities before authenticating them to the site. This oversight allows unauthenticated attackers to log in as any user, including administrators, provided they know the target username. The vulnerability has been assigned a CVSS score of 9.8, indicating its severe risk level. Security provider Wordfence has confirmed that this vulnerability is being actively exploited in the wild, having blocked 20 attack attempts within a 24-hour period. Attackers leveraging this flaw can bypass standard authentication mechanisms, seize control of user accounts, escalate privileges to administrator, and potentially install backdoors or inject malicious content. The widespread use of WordPress for enterprise, e-commerce, and personal websites amplifies the potential impact of this vulnerability. The Spirit Framework plugin is popular among WordPress site administrators, increasing the number of potentially affected sites. The developers have responded by releasing version 1.2.15 of the plugin, which patches the authentication bypass by ensuring proper identity validation. Website administrators are strongly urged to update to the latest version immediately to mitigate the risk of account takeover and privilege escalation. Failure to apply the patch leaves sites exposed to full compromise, including the risk of data theft, defacement, or further malware deployment. The vulnerability does not require knowledge of a password, only the username of a valid account, making exploitation relatively straightforward for attackers. The incident underscores the importance of prompt patch management and the risks associated with third-party plugins in widely used content management systems. Security advisories have been issued to alert the community, and monitoring for signs of compromise is recommended for sites running affected versions. The rapid exploitation observed highlights the need for continuous vigilance and timely response to critical vulnerabilities in the WordPress ecosystem. Organizations should review their plugin inventories and ensure all components are up to date to prevent similar incidents. The disclosure and patch release demonstrate effective collaboration between security researchers, vendors, and the broader WordPress community in addressing high-impact threats.
Jun 29, 2026