Threat Watch– active
All incidents
More on Threat Watch
More WordPress incidents
- WordPress Core: unauthenticated race in core update process leads to RCE; in CISA KEV (CVE-2026-119977) High · Patch now
- AfD email breach: 345,000 addresses leaked via hacked WordPress site Medium · Breach
- UpdraftCentral: stolen connection keys were used to backdoor WordPress sites (no CVE) Critical · Supply chain
- Rank Math SEO PRO 3.0.123: malware distributed in some downloads via compromised update channel (Oct 15–16, 2026) High · Supply chain · Closed
- WordPress Core Remote File Inclusion Vulnerability (CVE-2026-87902) High · Patch now · Closed
- CryptoPayment Gateway WordPress plugin: unauthenticated file deletion and wallet key theft (CVE-2026-81648) Critical · Patch now · Closed
Browse
Helix Cyber
Is your stack exposed? Get it tested.
The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.