Patchstack publishes reporting and resources in the Security section of WPURLs.
This blog post is about an unauthenticated remote code execution vulnerability in the GiveWP plugin. An attacker with no account can run arbitrary commands on the server of a GiveWP site that has one published donation form and one active payment gateway which, on the versions…
Run one WordPress site and a vulnerability is a single bad day. Run an agency, and it’s a portfolio-wide panic event that results in lost sleep and enough caffeine to take down a horse. Updates can’t close that gap alone, especially when attackers weaponize the most-targeted…
Reported by the DigitalOcean security team, with root cause analysis by DigitalOcean, coverage and vendor follow-up handled jointly with Patchstack. Most vulnerability write-ups are about the bug. This is primarily about everything around the bug, where the actual risk ended up…
This blog post is about an unauthenticated arbitrary file upload vulnerability in the Elementor Pro plugin that leads to remote code execution. The flaw lives in the Forms module’s File Upload field, where the extension check and the file-move step run in two separate loops with…
We’re excited to announce that FlyWP has integrated Patchstack into their platform, bringing proactive WordPress vulnerability protection to their customers through a new security add-on: FlySecurity Pro. FlyWP offers managed WordPress cloud hosting and server management. From a…
The latest WordPress maintenance release 7.0.4 includes a quiet but important security fix, and it’s one worth understanding rather than just clicking “update” past. It changes how WordPress hands your uploaded media to ImageMagick, and it closes a path that could let a…
WordPress 7.0.3 landed on 6 August 2026. It’s a security release with 12 different fixes covering pre-auth cross-site scripting (XSS), stored XSS, privilege escalation, information disclosure, CSS injection, an email verification bypass, and server-side request forgery…
We looked at the data: what WordPress.org’s 24-hour update delay means for vulnerabilities and supply-chain attacks. WordPress.org’s new update-review policy – Protect the Shire – is doing exactly what it was built to do – for one kind of threat. For another, it’s quietly making…
When we published our advisory on July 17, we ended it with the usual line: update immediately. We meant it, but we also knew what tends to happen next. A critical, unauthenticated, pre-auth chain in WordPress core is exactly the kind of bug that gets reverse-engineered from the…
Update: Patchstack has independently verified that these combined vulnerabilities can lead to full site takeovers, including remote code execution. We advise all users to update immediately and review your WordPress site for any users you don’t recognize. We are seeing this…
We are rolling out NodeJS/NPM vulnerability protection and supply chain security across all Patchstack web hosting & integration partners. If you’re not an existing partner, contact us here for more information. Vibe coding makes custom app building effortless for non technical…
Published June 15, 2026, by the Patchstack Team A supply chain attack against three popular WordPress marketing plugins (OptinMonster, TrustPulse, and PushEngage) served tampered JavaScript from their vendors’ CDNs to live websites. The injected code did not exploit a plugin…
Historically, Patchstack has aimed to keep its bug bounty program focused on vulnerabilities with a clear and meaningful security impact. The goal has always been to reward research that helps protect the wider WordPress ecosystem, while keeping the program practical to triage…
We’re excited to announce that HostArmada has integrated Patchstack into their platform – bringing proactive WordPress vulnerability protection to their customers through a new security add-on called Armada V-Shield. HostArmada is a fast-growing cloud hosting provider built…
This blog post is a technical analysis of a trojanized copy of WowShipping Pro version 1.0.6 for WordPress, a commercial plugin sold by WPXPO. Patchstack received a copy of the plugin from a site owner who traced a client site compromise back to it. The file contains a dropper…
This blog post is a technical analysis of the supply chain compromise affecting multiple plugins developed by EssentialPlugin for WordPress. A malicious party acquired EssentialPlugin, planted backdoor and triggered it across 20+ plugins to plant malware on thousands of…
This blog post is a technical analysis of the supply chain compromise affecting Smart Slider 3 Pro version 3.5.1.35 for WordPress. An unauthorized party gained access to Nextend’s update infrastructure and distributed a fully attacker-authored build through the official update…
Elementor – the website builder powering over 21 million WordPress sites – has integrated Patchstack into its site management dashboard – Manage. Real-time vulnerability detection is now built directly into the tool that agencies and web creators use to run their entire…
We’re excited to announce that JetHost has partnered with Patchstack to bring proactive vulnerability protection to WordPress websites hosted on its platform. JetHost is a modern hosting provider built by industry veterans with more than 20 years of experience, offering a…
We’re thrilled to announce that BigWetFish Hosting, a trusted UK & Ireland-based web hosting provider known for fast performance, dependable support, and WordPress-optimized hosting, has integrated Patchstack for proactive WordPress vulnerability protection. As part of this…
