Des failles critiques permettent à des pirates de prendre le contrôle de sites WordPress
Researchers at Searchlight Cyber have identified a critical chain of vulnerabilities in the WordPress core, dubbed WP2Shell, that allows remote code execution without authentication or installed plugins. By combining CVE-2026-63030 and CVE-2026-60137, attackers can compromise sites running versions 6.8.0 through 7.0.1, and active exploitation has already been confirmed by security firm watchTowr. WordPress has responded by forcing automatic updates to versions 6.9.5 and 7.0.2, though sites with disabled auto-updates remain exposed until administrators manually apply patches or implement temporary API restrictions.
CVE-2026-9833
A critical cross-site scripting vulnerability exists in the Tag Groups WordPress plugin versions prior to 2.2.0 due to insufficient escaping of an AJAX parameter. This flaw allows unauthenticated attackers to execute arbitrary JavaScript within the browser of any logged-in user holding Editor privileges or higher. The exploit requires only that the victim visits a crafted link, enabling potential data theft or session hijacking without prior authentication. Immediate patching to version 2.2.0 or later is required to close this security gap and prevent unauthorized code execution.