⚠️ WordPress Security: 3 CVEs in 48 Hours. One Is Already Taking Over Sites.
48 hours. Three new critical vulnerabilities. One of them has a public exploit and is actively pillaging sites right now.
Let me break each down — plain English.
🔴 CVE-2026-23550 — Modular DS Plugin (CVSS 10.0) — ACTIVE EXPLOITATION
This is the worst-case scenario.
A critical authentication bypass in Modular DS — a plugin used to manage multiple WordPress sites from one dashboard — allows unauthenticated attackers to log in as administrator simply by manipulating URL parameters.
No login form. No credentials. Just a crafted request.
Severity: CVSS 10.0 — the maximum score possible.
Impact: 40,000+ sites affected.
Status: Actively exploited in the wild. Patch is in version 2.5.2.
If you run Modular DS: update it right now. Then audit your admin accounts.
Source: The Hacker News, BleepingComputer, NVD
🟠 CVE-2026-1357 — WPvivid Backup & Migration (CVSS 9.8) — 900,000+ Sites
This one affects one of the most popular WordPress backup plugins, installed on over 900,000 websites.
Remote Code Execution via arbitrary file upload. An attacker can upload a malicious PHP file and execute it — giving them full control of your server.
Disclosed: February 12, 2026. Patch available: version 0.9.124.
This is a textbook supply-chain-risk scenario: a backup plugin with server-level file access, an unauthenticated RCE hole, and nearly a million exposed sites.
Source: BleepingComputer, SentinelOne, NVD
🟠 CVE-2026-0953 — Tutor LMS Pro (Auth Bypass) — 30,000+ Sites
The Social Login addon in Tutor LMS Pro fails to verify that the email in an OAuth authentication request matches the email validated by the OAuth token itself.
Translation: an attacker can hijack a legitimate social login — say, “Sign in with Google” — by supplying any email address they want. If that email matches an admin account on your site, they become admin.
All versions up to 3.9.5 are affected. Update to the latest version.
Source: Tenable, GitHub Advisory, NVD
🟡 CVE-2026-4056 — User Registration & Membership Plugin
Missing capability check on REST API endpoints. Any authenticated user with Contributor role or higher can modify content access rules they shouldn’t be able to touch.
Lower severity than the others, but still a privilege escalation path for anyone with an account on your site.
Source: NVD, OpenCVE, cvefeed.io
This Week’s Numbers:
• 331 new WordPress vulnerabilities published
• 120 still have no patch
• 11,334 WordPress vulnerabilities recorded in 2025 — a 42% jump over 2024
• Most severe exploits active within ~5 hours of disclosure
The Hard Reality:
Three of these four CVEs required no authentication to exploit. WPvivid and Modular DS are both actively targeted right now. Your site could be running a vulnerable plugin today and you wouldn’t know until it’s too late.
How SwissWPSuite Pro Helps:
SwissWPSuite Pro’s Security Sentinel provides a virtual patching layer while you work through your update queue:
✅ 28+ SQL injection detection patterns — blocks SQLi attacks like CVE-2026-4306, even when plugins are unpatched
✅ 40+ XSS detection patterns — stops malicious script execution before it happens
✅ Layer 2 AI analysis (Groq) — detects anomaly patterns for zero-day and variant attack types
✅ 3-layer recursive decode — catches obfuscated payloads that bypass basic scanners
✅ Real-time WAF rules — virtual patch coverage without waiting for vendor updates
While you’re identifying, downloading, testing, and deploying plugin updates — SwissWPSuite Pro is already blocking the attack patterns these vulnerabilities exploit.
The window between CVE disclosure and active exploitation is measured in hours. Your update cadence can’t always close it. SwissWPSuite can.
👉 swisswpsecure.com
#WordPressSecurity #WebSecurity #CVE #InfoSec #SwissWPSuite #WPSecurity #WordPressPlugins #CyberSecurity