Critical WordPress vulnerability affects versions dating back to 2016
A critical WordPress page-template vulnerability is already being probed. Learn which sites meet the known conditions, how to update, and what to check.
Read articleBlog
From the BugShield team
Product updates, WordPress advice, and stories from behind the shield.
Self-healing WordPress malware came back after cleanup
We removed the malicious files, but they returned from a payload hidden in the database. Here is how the persistence worked and why cleanup order mattered.
Read articleGravity Forms vulnerability puts hidden upload fields at risk
Gravity Forms 3.1.0.4 and earlier contain a critical unauthenticated file upload vulnerability. Learn who is exposed, how to update, and what to check.
Read articleWooCommerce Purple theme is back in beta
Purple 1.0.1 remains a pre-release, while WooCommerce 11.2 is available. Check the theme requirements, update route and store workflows before switching.
Read articleMatt Mullenweg returns as Automattic CEO after two days
Matt Mullenweg is back as Automattic CEO less than 48 hours after being placed on leave. Here is what is confirmed, what remains unclear, and what it means for WordPress owners.
Read articleUndetected WordPress malware, caught on day one
A customer thought their WordPress site was fine. Their first BugShield checks uncovered malware that had been sitting on the server for months.
Read articleMatt Mullenweg leave of absence: what it means for WordPress
Matt Mullenweg was placed on leave from Automattic and Mark Davies became interim CEO before a rapid reversal. Here is what changed and what it meant for WordPress.
Read articleRun PHP examples in your browser with WordPress Playground
Add runnable PHP examples to your own website with WordPress Playground, or try the first interactive examples in the official WordPress Code Reference.
Read articleElementor Pro 4.2.1 vulnerability: active attacks target file uploads
Elementor Pro 4.2.1 and earlier contain a critical file upload vulnerability under active attack. See who is exposed, what to check, and why you should update to 4.2.2.
Read articleAll-in-One WP Migration vulnerability: update to version 7.110
All-in-One WP Migration 7.109 and earlier contain a serious SQL injection vulnerability. Learn how the issue works and what WordPress site owners should do.
Read articleWP Rocket incompatibility with WordPress 7.1: update WP Rocket first
WP Rocket incompatibility with WordPress 7.1 was fixed in 3.23.2.2. Identify the fatal error, recover access and test current releases before updating live.
Read articleWishlist Member account takeover: unauthenticated mergewith bug in 3.34.1
Wishlist Member account takeover, CVE-2026-12949, affects versions through 3.34.1. Learn about the 3.34.2 fix, current update advice and account checks.
Read article