Matt Mullenweg leave of absence: what it means for WordPress
Matt Mullenweg is on leave from Automattic and Mark Davies is interim CEO. Here is what changed, what did not, and what WordPress owners should know.
Read articleBlog
From the BugShield team
Product updates, WordPress advice, and stories from behind the shield.
Run PHP examples in your browser with WordPress Playground
Add runnable PHP examples to your own website with WordPress Playground, or try the first interactive examples in the official WordPress Code Reference.
Read articleElementor Pro 4.2.1 vulnerability: active attacks target file uploads
Elementor Pro 4.2.1 and earlier contain a critical file upload vulnerability under active attack. See who is exposed, what to check, and why you should update to 4.2.2.
Read articleAll-in-One WP Migration vulnerability: update to version 7.110
All-in-One WP Migration 7.109 and earlier contain a serious SQL injection vulnerability. Learn how the issue works and what WordPress site owners should do.
Read articleWP Rocket incompatibility with WordPress 7.1: update WP Rocket first
WP Rocket incompatibility with WordPress 7.1 can cause a fatal error. Do not update WordPress until WP Rocket 3.23.2.2 or later is installed.
Read articleWishlist Member account takeover: unauthenticated mergewith bug in 3.34.1
Wishlist Member account takeover is an unauthenticated bug in WishList Member X through 3.34.1 via the mergewith parameter. See who is affected and what to do.
Read articleWordPress 7.0.4: Author-level Postscript upload RCE (CVE-2026-65640)
WordPress 7.0.4 patches CVE-2026-65640, an Author-level Postscript upload RCE when Imagick and Ghostscript are present. See who is affected and what to do.
Read articleWordPress plugin supply chain attack: BdThemes plugins created rogue admins
A WordPress plugin supply chain attack hit BdThemes in August 2026. See which plugins were affected, how hidden admins were created, and how to check your site.
Read articleWordPress XSS2Shell: what it is, who is at risk, and how to check
WordPress XSS2Shell (CVE-2026-64638) is a login XSS that can lead to RCE. See who is at risk, patched versions, and check your site with our free tool.
Read articleAccount security first: 2FA and Active Sessions on BugShield
WordPress security is not only plugins and scans. Optional authenticator 2FA and Active Sessions help lock down the BugShield account that holds your sites and vault.
Read article