WordPress

Everything Payload Report has reported about WordPress: 2 stories, newest first. Part of our Vulnerabilities coverage.

Vulnerabilities

Abandoned Cart Pro Malleable Encryption CVE-2026-97657 Allows Universal Account Takeover via Token Forgery

Unauthenticated attackers can hijack any user account, including administrators, by forging cart-recovery tokens in vulnerable plugin versions.

Oct 14, 2026

Vulnerabilities

Blocksy Companion Auth Bypass Lets Attackers Publish Content Without Login

A critical flaw in the Blocksy Companion WordPress plugin lets attackers bypass security checks to seize seller roles and publish content without logging in.

Oct 10, 2026