Vulnerabilities
PHP Security Team Plans Oct 21 Release for Two 9.2 CVSS Vulnerabilities
The PHP project confirms an October 21 release addressing two vulnerabilities rated 9.2 on CVSS v4.0, impacting environments running the language.
WordPress
Everything Firewall Chronicle has reported about WordPress: 6 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
WordPress TinyMCE Thumbnail Gallery Path Traversal Exposes Files
Unauthenticated attackers can read arbitrary files in WordPress sites running TinyMCE Thumbnail Gallery versions prior to 1.1.0 via a path traversal flaw.
Cyber Attacks
Rank Math PRO Vulnerability: Malicious Updates Re-plant Backdoors on Every Page Visit
Malicious updates to Rank Math PRO version 3.0.123 distributed over an 11-hour window can recreate hidden backdoors on every page visit.
Vulnerabilities
DoubleScale CRM Plugin Permits Arbitrary File Uploads via Broken Validation
Authenticated users can upload executable files in DoubleScale CRM versions up to 1.5.1 due to a flawed extension check and missing capability restrictions.
Vulnerabilities
Advanced IP Blocker Zero-Day Lets Attackers Steal Session Cookies to Bypass 2FA
A critical flaw in the Advanced IP Blocker WordPress plugin lets attackers bypass two-factor authentication and seize full site control without passwords.
Vulnerabilities
Avada Builder Hook Injection Flaw Lets Attackers Wipe Site Content Without Login
Unauthenticated attackers can trigger arbitrary WordPress hooks in Avada Builder versions up to 7.16.1, causing irreversible site damage.