Tag

security fixes

The Events Calendar unauthenticated RCE chains: check the plugin version with WP-CLI and patch to 6.17.4.1 or later

Sep 29, 202617 min

The Events Calendar Vulnerability: Two RCE Chains, Patch Now

Two unauthenticated RCE chains in The Events Calendar (CVE-2026-78006 and CVE-2026-78159) start from an event comment. Who is exposed, WP-CLI checks for one site or a fleet, the patch, and what to hunt for.

plugin security security fixes

WordPress 7.1.2 path traversal fix: validate_file and _wp_is_template_path_allowed in wp-includes/template.php, with the theme and server pre-conditions

Sep 24, 202614 min

WordPress 7.1.2 Path Traversal: Who Is Exposed, What to Do

WordPress 7.1.2 patches an unauthenticated path traversal in page template resolution that can become remote code execution. Which themes and servers are exposed, how to prove a site is patched, and how to update safely, including Composer and Docker.

CVE vulnerabilities security fixes