Back Cybersecuritynews

WordPress Backup Plugin Vulnerability Exposes 800,000 Sites to Remote Code Execution Attacks

Cybersecuritynews •Tushar Subhra Dutta • February 12, 2026

A critical flaw in the WPvivid Backup & Migration WordPress plugin can let an unauthenticated attacker upload files and run code on the server, a path that often ends in full site takeover. The issue is tracked as CVE-2026-1357, scored 9.8 (Critical), and affects plugin versions up to and including 0.9.123, with a fix available […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Over 40,000 WordPress Sites Compromised by SQL Injection Vulnerability An SQL injection vulnerability has been identified in versions 10.3.1 and prior of the QSM plugin for WordPress, affecting over 40,000 sites. Users with 'subscriber' accounts or higher privileges can exploit this flaw, as noted in a security advisory from Patchstack. 5 sources 65

Extracted Entities

WordPress Backup Plugin Vulnerability Exposes 800,000 Sites to Remote Code Execution Attacks

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)