A Critical WordPress Vulnerability Affects Thousands of Sites, Leaving Them Open to Takeover or Remote Code Execution
In a shocking revelation, it’s been discovered that five critical vulnerabilities in popular WordPress plugins and themes have left thousands of websites vulnerable to takeover or remote code execution. These flaws, which affect some of the most widely used plugins and themes on the platform, allow attackers to exploit sensitive data and manipulate website content with ease.
The affected plugins and themes are part of the WordPress ecosystem, which is relied upon by millions of users worldwide. The vulnerabilities were identified in a series of security audits conducted by independent researchers, who mapped out active attack paths that could lead to site takeover or remote code execution (RCE). According to experts, these flaws can be exploited through cross-domain privilege escalation, which enables attackers to bypass security measures and gain unauthorized access.
The first vulnerability affects the “WP File Manager” plugin, a popular tool for managing files on WordPress sites. This flaw allows an attacker to execute arbitrary PHP code, potentially leading to site takeover or RCE. The second vulnerability is found in the “ThemeREX CMS” theme, which is widely used by developers and web designers. In this case, attackers can inject malicious code into website content, compromising user data and functionality.
Another affected plugin is the “Contact Form DB” plugin, which allows users to view, edit, or delete form submissions on their WordPress site. However, due to a critical vulnerability in its code, an attacker can manipulate database queries, potentially leading to RCE. Similarly, the “User Role Editor” plugin has been found to have a flaw that enables attackers to escalate privileges and gain unauthorized access to sensitive areas of the website.
The fifth and most severe vulnerability affects the “Duplicator Pro” plugin, which is used for cloning and migrating WordPress sites. In this case, an attacker can execute malicious code on the target site, potentially leading to RCE or even site takeover. The researchers have identified that these vulnerabilities are not isolated incidents but rather a result of poor coding practices and lack of security measures in some plugins.
The discovery of these critical vulnerabilities serves as a stark reminder of the importance of website security. With thousands of sites affected, it’s essential for web administrators to take immediate action to patch their WordPress installations. This includes updating vulnerable plugins and themes, changing passwords, and implementing additional security measures to prevent future attacks. By prioritizing website security, users can protect sensitive data and maintain trust in online transactions.
For those affected by these vulnerabilities, the first step is to scan your WordPress site for any affected plugins or themes using reputable security tools. Once identified, update or replace the vulnerable components immediately, and consider implementing additional security measures such as a web application firewall (WAF) to prevent future attacks.
Source: The Hacker News — 2026-08-29