wordpress

6 articles · newest first

the WordPress sites getting owned by wp2shell all have one thing in common — and it isn't bad luck

If your WordPress lives on managed hosting, you were probably patched before you'd even read the news. The sites actually exposed to wp2shell share a specific setup — here's whether yours is one of them.

Priya Nair · 1h ago · 8 min

A laptop on a desk, ready for a WordPress security audit

Software

you updated WordPress and moved on. here's the 10-minute audit that tells you if you're actually safe — or already owned

Clicking 'update' closes the door. It doesn't check whether someone already walked through it, or whether the other doors are locked. A practical, no-nonsense checklist for after a critical WordPress vulnerability.

Priya Nair · 1h ago · 9 min

Software

96% of WordPress security holes are in plugins. wp2shell is one of the 4% that should actually scare you

Most WordPress vulnerabilities live in plugins and themes you can uninstall. A flaw in core itself — reachable on a default install with no add-ons — is a different, rarer animal. The data on why wp2shell stands out.

Priya Nair · 1h ago · 8 min

WordPress.org documentation page for version 6.9.5 security release

Software

WordPress just updated millions of sites without asking. that's rarer than you think — and here's how to check it worked

The forced auto-update push behind the wp2shell fix is a mechanism WordPress has used only a handful of times. What it is, why they broke the 'we don't touch your site' rule, and how to confirm your install actually got it.

Priya Nair · 1h ago · 8 min

Lines of code on a dark screen representing a security vulnerability

Software

there's a second WordPress bug this month — and this one has no patch, just a plugin you need to switch off tonight

While everyone patched the wp2shell core flaw, a 9.8-rated hole in a popular login plugin quietly went public with no fix available. If you run miniOrange's OAuth SSO, updating WordPress didn't save you.

Priya Nair · 1h ago · 7 min

Software

run WordPress? stop and update right now — this bug hands your entire site to a stranger

no login. no plugin. no weird setup. one anonymous request and a stranger owns a default WordPress site. the fix is out — here's exactly what to check before you assume you're safe.

Priya Nair · 4d ago · 5 min