Everything Firewall Pulse has reported about WordPress: 4 stories, newest first. Part of our Vulnerabilities coverage.
The National Vulnerability Database rates CVE-2026-62046 as critical, warning that untrusted data handling in the Gutentype plugin enables object injection.
Deserialization of untrusted data in the Convex plugin exposes WordPress sites to remote object injection attacks requiring immediate attention.
A critical authentication bypass in the WPCOM Member plugin for WordPress allows attackers to hijack admin accounts by forging social login sessions without valid credentials.
A critical vulnerability in the ThemeREX Greeny WordPress theme allows object injection through untrusted data deserialization in versions up to 2.10.0.