The Next Web

A WordPress plugin sold to 15,000 sites has a flaw that lets anyone create an admin account, and attackers are already using it

A critical vulnerability (CVE-2026-8732, CVSS 9.8) in the WP Maps Pro WordPress plugin allows unauthenticated attackers to create admin accounts and take over sites. Wordfence blocked 2,858 ...
Hosted on MSN

A single flaw in the WordPress plugin Everest Forms lets attackers seize full control of a website, and thousands are exposed

Website owners running the Everest Forms Pro plugin for WordPress face an urgent threat: a single vulnerability, tracked as CVE-2026-3300, allows unauthenticated attackers to inject and execute ...
Bleeping Computer

WordPress membership plugin bug exploited to create admin accounts

Hackers are exploiting a critical vulnerability in the User Registration & Membership plugin, which is installed on more than 60,000 WordPress sites. Developed by WPEverest, the plugin provides ...