WordPress PBN Plugin Drops Dual Webshells via Database Injection
Puja Srivastava During a recent incident response engagement, our team uncovered a multi-stage WordPress infection that goes beyond the usual file-based malware. The attacker combined a fake…
Browsing Tag
WordPress Plugins and Themes
333 posts
Vulnerability & Patch Roundup — May 2026
Sucuri Malware Research Team If you run a website, you know that a single unpatched vulnerability can take your site offline, damage your reputation, or leave you cleaning up…
WordPress Site Down? Here’s How to Get Back Online
Kyle Knight If your WordPress site goes offline, every minute costs you lost sales, missed leads, and a dent in visitor trust. Search engines may start flagging…
Vulnerability & Patch Roundup — April 2026
Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes…
Vulnerability & Patch Roundup — March 2026
Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes…
The Security Risks of Using Nulled WordPress Plugins
Sucuri Every year, thousands of WordPress sites get compromised, and a surprising number of those infections trace back to a single decision: installing a nulled plugin.…
Vulnerability & Patch Roundup — February 2026
Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes…
Vulnerability & Patch Roundup — January 2026
Vulnerability reports and responsible disclosures are essential for website security awareness and education. Automated attacks targeting known software vulnerabilities are one of the leading causes…
Shadow Directories: A Unique Method to Hijack WordPress Permalinks
Last month, while working on a WordPress cleanup case, a customer reached out with a strange complaint: their website looked completely normal to them and…
Malware Intercepts Googlebot via IP-Verified Conditional Logic
Some attackers are increasingly moving away from simple redirects in favor of more “selective” methods of payload delivery. This approach filters out regular human visitors,…
Fake Browser Updates Targeting WordPress Administrators via Malicious Plugin
We recently investigated a case involving a WordPress website where a customer reported persistent fake pop-up notifications appearing on their site. The warnings were urging…