wordpress2 articles
Nearly 2,000 Hacked WordPress Sites Are Powering a Surprisingly Sophisticated Criminal Operation
A large-scale cybercrime operation called **StopAndProtect** has compromised nearly 2,000 outdated WordPress websites, using them as infrastructure to distribute malware, issue attacker commands, and store stolen data from victims. The campaign begins with fake ClickFix CAPTCHA prompts that trick users into running malicious PowerShell commands, deploying a toolkit that includes ransomware, a credential stealer, a screen locker, a worm, and a chat utility for communicating with victims. As of late July 2026, over 6,000 unique IP addresses have been compromised, with researchers urging users to be wary of unexpected CAPTCHA prompts that instruct them to run commands outside the browser.
Half a Million WordPress Sites Running Vulnerable Form Plugin — 300,000 Still Unpatched
A critical remote code execution vulnerability (CVE-2026-15748, CVSS 9.8) has been discovered in the Forminator Forms WordPress plugin, affecting all versions up to 1.56.1. The flaw allows unauthenticated attackers to bypass file type validation and upload executable files, potentially leading to full site compromise — but only poses a significant risk when a Custom File Upload Storage root has been configured. The bug was patched in version 1.56.2 on July 31, though roughly 300,000 of the plugin's 600,000+ installations are still running a vulnerable version.