On July 18th, 2025, we received a submission for an Arbitrary File Upload vulnerability in AI Engine, a WordPress plugin with more than 100,000 active installations. This vulnerability can be used by authenticated attackers, with subscriber-level access and above, to upload arbitrary files to a vulnerable site and achieve remote code execution, which is typically leveraged for a complete site takeover. Please note that this vulnerability only critically affects users who have enabled the “Public API” option in the settings, which is disabled by default, and have not configured authentication for the API.

Props to ISMAILSHADOW who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This vulnerability was disclosed to our program just one day after it was introduced. This researcher earned a bounty of $1,170.00 for this discovery.

Users of paid versions of Wordfence received a firewall rule to protect against any exploits targeting this vulnerability on July 21, 2025. Sites using the free version of Wordfence will receive the same protection 30 days later on August 20, 2025.

We provided full disclosure details to Jordy Meow instantly through our Wordfence Vulnerability Management Portal on July 18, 2025. The developer released the patch on July 22, 2025. We would like to commend Jordy Meow for their prompt response and timely patch.

This vulnerability is an incredible example of the positive impact the Wordfence Bug Bounty Program has on the WordPress ecosystem. The vulnerability was introduced on July 17th, 2025, and just one day later was reported to our Bug Bounty Program, triaged, sent to the developer, and patched a few days later, creating a narrow opportunity for attackers to discover and exploit this vulnerability before site owners were protected. Extra special kudos to the researcher ISMAILSHADOW for discovering this vulnerability so quickly and to Jordy Meow for remediating the vulnerability so quickly.

We urge users to update their sites with the latest patched version of AI Engine, version 2.9.5 at the time of this publication, as soon as possible.

Source and more details: https://www.wordfence.com/blog/2025/07/100000-wordpress-sites-affected-by-arbitrary-file-upload-vulnerability-in-ai-engine-wordpress-plugin

On May 30th, 2025, Wordfence received a submission for an Arbitrary File Upload via Plugin Installation vulnerability in Alone, a WordPress theme with more than 9,000 sales. This vulnerability makes it possible for an unauthenticated attacker to upload arbitrary files to a vulnerable site and achieve remote code execution, which is typically leveraged for a complete site takeover. The vendor released the patched version on June 16th, 2025, and Wordfence publicly disclosed this vulnerability on July 14th, 2025. Their records indicate that attackers started exploiting the issue on July 12th, 2025, before Wordfence disclosed the vulnerability. The Wordfence Firewall has already blocked over 120,900 exploit attempts targeting this vulnerability.

 Users of paid versions of Wordfence received a firewall rule to protect against any exploits targeting this vulnerability on May 30, 2025. Sites using the free version of Wordfence received the same protection after the standard 30-day delay on June 29, 2025.

We urge users to ensure their sites are updated with the latest patched version of Alone, version 7.8.5 at the time of this writing, as soon as possible, as this vulnerability is under active exploitation.

Source and more details: https://www.wordfence.com/blog/2025/07/attackers-actively-exploiting-critical-vulnerability-in-alone-theme

See also: https://thehackernews.com/2025/07/hackers-exploit-critical-wordpress.html

Cybersecurity researchers have uncovered a new stealthy backdoor concealed within the “mu-plugins” directory in WordPress sites to grant threat actors persistent access and allow them to perform arbitrary actions.

Must-use plugins (aka mu-plugins) are special plugins that are automatically activated on all WordPress sites in the installation. They are located in the “wp-content/mu-plugins” directory by default.

What makes them an attractive option for attackers is that mu-plugins do not show in the default list of plugins on the Plugins page of wp-admin and cannot be disabled except by removing the plugin file from the must-use directory.

As a result, a piece of malware that leverages this technique allows it to function quietly, without raising any red flags.

In the infection spotted by web security company Sucuri, the PHP script in the mu-plugins directory (“wp-index.php”) serves as a loader to fetch a next-stage payload and save it in the WordPress database within the wp_options table under _hdra_core.

The remote payload is retrieved from a URL that’s obfuscated using ROT13, a simple substitution cipher that replaces a letter with the 13th letter after it (i.e., A becomes N, B becomes O, C becomes P, and so forth).

“The fetched content is then temporarily written to disk and executed,” security researcher Puja Srivastava said. “This backdoor gives the attacker persistent access to the site and the ability to run any PHP code remotely.

Specifically, it injects a hidden file manager into the theme directory as “pricing-table-3.php,” permitting threat actors to browse, upload, or delete files. It also creates an administrator user named “officialwp” and then downloads a malicious plugin (“wp-bot-protect.php”) and activates it.

Besides reinstating the infection in the event of deletion, the malware incorporates the ability to change the passwords of common administrator usernames, such as “admin,” “root,” and “wpsupport,” to a default password set by the attacker. This also extends to its own “officialwp” user.

In doing so, the threat actors can enjoy persistent access to the sites and perform malicious actions, while effectively locking out other administrators. This can range from data theft to injecting code that can serve malware to site visitors or redirect them to other scammy sites.

“The attackers gain full administrator access and a persistent backdoor, allowing them to do anything on the site, from installing more malware to defacing it,” Srivastava said. “The remote command execution and content injection features mean the attackers can change the malware’s behavior.”

To mitigate against these threats, it’s essential that site owners update WordPress, themes, and plugins periodically, secure accounts using two-factor authentication, and regularly audit all sections of the site, including theme and plugin files.

Source and more details: https://thehackernews.com/2025/07/hackers-deploy-stealth-backdoor-in.html

On June 24th, 2025, Wordfence received a submission for an Arbitrary File Upload and an Arbitrary File Deletion vulnerability in HT Contact Form, a WordPress plugin with more than 10,000 active installations. The arbitrary file upload vulnerability can be used by unauthenticated attackers to upload arbitrary files to a vulnerable site and achieve remote code execution, which is typically leveraged for a complete site takeover. The arbitrary file deletion vulnerability can be used by unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can also make a site takeover possible.

On July 4th, 2025, Wordfence also received a submission for an Arbitrary File Move vulnerability in HT Contact Form. This vulnerability can be used by unauthenticated attackers to move arbitrary files, including the wp-config.php file, which can also make a site takeover possible.

All Wordfence users are protected against any exploits targeting these vulnerabilities by the Wordfence firewall’s built-in Malicious File Upload and Directory Traversal protections.

Props to vgo0 and Phat RiO – BlueRock, who discovered and responsibly reported these vulnerabilities through the Wordfence Bug Bounty Program. These researchers earned bounties of $1,431.00, $991.00 and $675.00 for their discoveries.

Wordfence contacted the HasTech IT team on July 8, 2025, and they registered on our Wordfence Vulnerability Management Portal for WordPress vendors on July 9, 2025. After receiving the full disclosure details instantly through the portal, the developer released the patch on July 13, 2025. We would like to commend the HasTech IT team for their prompt response and timely patch.

We urge users to update their sites with the latest patched version of HT Contact Form, version 2.2.2 at the time of this writing, as soon as possible.

Source and more details: https://www.wordfence.com/blog/2025/07/10000-wordpress-sites-affected-by-critical-vulnerabilities-in-ht-contact-form-wordpress-plugin

On June 21st, 2025, we received a submission for an Arbitrary File Deletion vulnerability in SureForms, a WordPress plugin with more than 200,000 active installations. This vulnerability makes it possible for unauthenticated threat actors to specify arbitrary file paths in a form submission, and the file will be deleted when the submission is deleted. It can be leveraged to delete critical files like wp-config.php, which can lead to remote code execution.

Props to Phat RiO – BlueRock who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $4,050.00 for this discovery.

Users of paid versions of Wordfence received a firewall rule to protect against any exploits targeting this vulnerability on June 26, 2025. Sites using the free version of Wordfence will receive the same protection 30 days later on July 26, 2025.

We contacted the Brainstorm Force team on June 25, 2025, and received a response the next day. After providing full disclosure details, the developer released the patch on June 30, 2025. We would like to commend the Brainstorm Force team for their prompt response and timely and transparent patch.

The Brainstorm Force team took extra steps to help protect their users with point releases back 8 versions, and worked with the WordPress plugins team to undergo a forced update. Most sites running SureForms should be updated to a patched version, however, we urge users to verify their sites are updated with one of the patched versions (1.7.4, 1.6.5, 1.5.1, 1.4.5, 1.3.2, 1.2.5, 1.1.2, 1.0.7, 0.0.14) of SureForms as soon as possible. The Brainstorm Force organization provided an exemplary example of how high threat security issues should be handled.

Source and more details; https://www.wordfence.com/blog/2025/07/200000-wordpress-sites-affected-by-arbitrary-file-deletion-vulnerability-in-sureforms-wordpress-plugin

On June 20th, 2025, we received a submission for an Arbitrary File Deletion vulnerability in Forminator, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for unauthenticated threat actors to specify arbitrary file paths in a form submission, and the file will be deleted when the submission is deleted. It can be leveraged to delete critical files like wp-config.php, which can lead to remote code execution.

Props to Phat RiO – BlueRock who discovered and responsibly reported this vulnerability through the Wordfence Bug Bounty Program. This researcher earned a bounty of $8,100.00 for this discovery, the top bounty awarded through our program so far.

Paid Wordfence users received a firewall rule to protect against any exploits targeting this vulnerability on June 26, 2025. Sites using the free version of Wordfence will receive the same protection 30 days later on July 26, 2025.

We contacted the WPMU DEV team on June 23, 2025, and they registered on our Wordfence Vulnerability Management Portal for WordPress vendors on June 25, 2025. After receiving the full disclosure details instantly through the portal, the developer released the patch on June 30, 2025. We would like to commend the WPMU DEV team for their prompt response and timely patch.

We urge users to update their sites with the latest patched version of Forminator, version 1.44.3 at the time of this writing, as soon as possible.

Source and more details: https://www.wordfence.com/blog/2025/07/600000-wordpress-sites-affected-by-arbitrary-file-deletion-vulnerability-in-forminator-wordpress-plugin