Website security

October 18, 2026

Rank Math PRO 3.0.123 Malware: Why 3.0.124 Alone Won’t Clean Your Site

Some Rank Math PRO 3.0.123 downloads carried malware for about 11 hours. Here's how to check your copy and why version 3.0.124 alone won't clean an affected site....Read…

October 16, 2026

A Backup Restore Could Hand Over Your WordPress Site

UpdraftPlus and Backuply fixed flaws that could turn a backup restore into a site takeover. Here's what to update and what to check afterward....Read More...

October 12, 2026

Avada Form Bug Can Empty Your WordPress Trash - Update Avada Builder

A public Avada form can let a stranger permanently empty your WordPress trash. Here’s what’s affected, how to update, and what to check today....Read More...

October 11, 2026

Your AI Chatbot Can Attack Your WordPress Admin

A bug in AI Engine could turn chatbot input into code running in a WordPress admin’s browser. Jotform AI Chatbot has a separate bug with no official patch…

October 7, 2026

Ninja Forms and WPC Product Bundles Attacks: Check for Hidden WordPress Backdoors

Attackers are using flaws in Ninja Forms and WPC Product Bundles to plant a fake plugin, hidden admin accounts and a secret login. Here’s how to check your…

September 29, 2026

WPForms Stripe refund flaw - update to 2.0.2 or newer

A WPForms flaw could trigger refunds and cancel subscriptions on a shared Stripe account. Here's how to check your version and look for trouble....Read More...

September 28, 2026

Elementor 4.3.0 and 4.3.1 - why one admin click could add an admin

A flaw in the free Elementor plugin could let a link opened by a logged-in admin create another admin account. Check whether you're on 4.3.0 or 4.3.1 and…

September 24, 2026

How to tell if a plugin CVE actually affects YOUR site - version + path check

You see a scary headline: “Critical vulnerability in Popular Plugin X.” Your stomach drops a little. Maybe you use that plugin. Maybe...Read More...

September 23, 2026

Updated WordPress last week? Update again - attackers started probing in under five hours

You updated WordPress last week. Good. Now update it again. WordPress 7.1.1 arrived on September 17 with maintenance work and 11 security...Read More...

September 22, 2026

What a malware scan actually checks - and what it misses

You run a scan, it says everything looks clean, and you breathe out a little. Fair enough. That’s how these tools are...Read More...

September 17, 2026

An unapproved event comment could take over WordPress - update The Events Calendar

A stranger leaves a comment on an event page. You never approve it. It sits in moderation, invisible to normal visitors, while...Read More...

September 17, 2026

Leftover installers, coming-soon pages, and phpinfo files attackers still find

You’d be surprised what attackers still find on small business websites. Not fancy zero-day stuff. Not movie hacker nonsense. Just forgotten junk...Read More...