A developer released a WordPress plugin that replaces visible CAPTCHAs with a silent proof-of-work challenge, requiring visitors' browsers to solve a small cryptographic puzzle before submitting forms. The plugin claims to work across logins, registrations, comments, WooCommerce checkout and major form builders like Contact Form 7, WPForms and Gravity Forms by recognizing submission signatures rather than relying on per-plugin integrations, and it offers a manual mode to learn custom or unsupported forms.
wordpress.org
· 2026-10-22
Patchstack disclosed a cross-site request forgery flaw in the Elementor Website Builder plugin, affecting versions 4.3.0 and 4.3.1, used on up to 2 million WordPress sites. The bug let attackers trick a logged-in administrator into clicking a malicious link that silently created a new admin account under attacker control. Elementor patched the issue in version 4.3.2, released two days after Patchstack's report.
bleepingcomputer.com
· 2026-09-25
A threat actor breached the website of Admin Menu Editor Pro maintainer Janis Elsts and pushed a malicious version 2.35 update that installed a web shell and created a hidden admin account on customer sites. Even after Elsts released a clean version 2.36, the attacker retained access and compromised that release too, affecting an estimated 230 customers and at least 1,500 sites.
bleepingcomputer.com
· 2026-09-15
Hackers are exploiting an unauthenticated file-upload vulnerability (CVE-2026-27540) in the WooCommerce Wholesale Lead Capture plugin for WordPress, versions 2.0.3.1 and earlier, to install PHP webshells. Wordfence says its firewall has blocked over 100,000 attack attempts, with spikes in June, July and August, and the shells allow attackers to gather site information and upload further malicious files.
bleepingcomputer.com
· 2026-09-15
GoKawiil