My WordPress Website Was Hacked
Tony Perez Before you freak out, allow me to clarify. It was one of several honeypots we have running. The honeypots are spread across the most commonly…
Browsing Category
WordPress Security
698 posts
Thoughts on WordPress Security and Vulnerabilities
David Dede As avid readers of this blog know, we’ve discovered or written about multiple vulnerabilities within the WordPress ecosystem over the last couple of weeks specifically…
Website Malware: Mobile Redirect to BaDoink Porn App Evolving
Peter Gramantik Recently, we wrote about a malware redirect causing compromised sites to redirect their visitors to pornographic content (specifically, the BaDoink app). You can read more…
Critical Vulnerability Disclosed on WordPress Custom Contact Forms Plugin
Marc-Alexandre Montpas If you’re a using the Custom Contact Forms WordPress plugin, you need to update it right away. During a routine audit for our WAF, we…
WordPress and Drupal Core Denial Of Service Vulnerability – Moderately Critical
Both WordPress and Drupal are affected by a DoS (denial of service) vulnerability on the PHP XML parser used by their XMLRPC implementations. The issue…
New Brute Force Attacks Exploiting XMLRPC in WordPress
Daniel Cid Brute force attacks against WordPress have always been very common. In fact, Brute Force attacks against any CMS these days is a common occurrence, what…
MailPoet Vulnerability Exploited in the Wild – Breaking Thousands of WordPress Sites
A few weeks ago we found and disclosed a serious vulnerability on the MailPoet WordPress Plugin. We urged everyone to upgrade their sites immediately due…
Massive Malware Infection Breaking WordPress Sites
Update: We identified the root cause: MailPoet Vulnerability Exploited in the Wild – Breaking Thousands of WordPress Sites. The last few days has brought about…
Disclosure: Insecure Nonce Generation in WPtouch
If you use the popular WPtouch plugin (5M+ downloads) on your WordPress website, you should update it immediately. During a routine audit for our WAF,…
Ask Sucuri: Who is Logging into My WordPress Site?
Today, we’re going to revisit our Q&A series. If you have any questions about malware, blacklisting, or security in general, send them to us at:…
Remote File Upload Vulnerability in WordPress MailPoet Plugin (wysija-newsletters)
Marc-Alexandre Montpas, from our research team, found a serious security vulnerability in the MailPoet WordPress plugin. This bug allows an attacker to upload any file…