Vulnerabilities
NativeChurch WordPress Theme Path Traversal Allows Arbitrary File Download
An unauthenticated flaw in the NativeChurch theme permits attackers to traverse directories and steal sensitive configuration files from exposed servers.
WordPress
Everything NetSec Observer has reported about WordPress: 8 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
WP Strong Testimonials Object Injection Flaw in Versions Through 3.3.12
The National Vulnerability Database rates CVE-2026-107436 as a high severity issue that allows object injection via untrusted data deserialization.
Vulnerabilities
User Registration Plugin CVE-2026-92798: Unauthenticated Shortcode Execution via HTTP_REFERER
Unauthenticated attackers can trigger arbitrary shortcode execution via the HTTP_REFERER header in affected versions of the User Registration & Membership plugin.
Vulnerabilities
itthinx Affiliates Deserialization Bug CVE-2026-108291 Hits 9.8 CVSS for Versions Up to 7.0.1
A critical deserialization vulnerability in itthinx Affiliates versions up to 7.0.1 allows object injection of untrusted data.
Vulnerabilities
Partiso Theme Untrusted Data Deserialization: Critical CVE-2026-93934 Hits Versions <= 1.1.13
The National Vulnerability Database rates CVE-2026-93934 as critical, affecting Partiso theme versions up to 1.1.13 through untrusted data deserialization.
Vulnerabilities
Wine House Theme PHP Object Injection: CVE-2026-62053 Grants Remote Code Execution
The National Vulnerability Database lists CVE-2026-62053 as a critical flaw affecting ThemeREX Wine House versions up to 3.20, allowing remote code execution.
Vulnerabilities
3D Product Configurator: Commented-Out Check Enables Unauthenticated RCE on WordPress via Single POST
A commented-out security check in the 3D Product Configurator plugin allows attackers to execute arbitrary code on WordPress servers without logging in.
Vulnerabilities
Blocksy Companion Auth Bypass Flaw Grants Unchecked Vendor Privileges on WordPress
Unauthenticated attackers can bypass security checks in Blocksy Companion to gain seller privileges and publish content on WordPress sites.