ClickFix Malware Campaign: Decentralized Payload Hosting via WordPress Exploitation
A widespread cyberattack campaign has compromised over 5,400 WordPress websites to distribute multi-stage malware using the "ClickFix" social engineering technique. Attackers leverage critical RCE vulnerabilities in plugins—including CVE-2026-14894 (Super Forms) and CVE-2026-32475 (Elementor Pro)—to inject scripts that display deceptive Cloudflare CAPTCHAs or browser error prompts. These lures trick users into manually executing malicious PowerShell or Terminal commands. To ensure resilience, the campaign utilizes "EtherHiding," hosting payloads and C2 resolution on the Polygon and BNB Smart Chain blockchains. Impacted systems are infected with diverse payloads, including DeepLoad, KongTuke (ModeloRAT), and ACR Stealer, targeting both Windows and macOS environments for enterprise credential theft and network intrusion.
Critical RCE Vulnerability CVE-2026-3300 in Everest Forms Pro
A critical Remote Code Execution (RCE) vulnerability, tracked as CVE-2026-3300, is currently being exploited in the wild against the Everest Forms Pro WordPress plugin. The flaw, carrying a CVSS score of 9.8, stems from improper input validation within the plugin's "complex calculation" feature. Unauthenticated attackers can leverage this vulnerability to execute arbitrary code, facilitating complete administrative takeover of affected WordPress environments. With approximately 4,000 active installations vulnerable, threat actors are utilizing specific payload patterns to trigger the calculation engine, leading to webshell deployment, unauthorized user creation, and potential data exfiltration. Immediate patching to version 1.9.13 or higher is required to mitigate this high-risk threat.
Critical Authentication Bypass Vulnerabilities in Xecurify miniOrange SAML WordPress Plugin
Two critical authentication bypass vulnerabilities, CVE-2026-61979 and CVE-2026-15981 (CVSS 9.8), were identified in the Xecurify miniOrange SAML 2.0 Single Sign On WordPress plugin. Attackers exploit flaws in SAML response processing and assertion data manipulation to circumvent Single Sign-On (SSO) logic, allowing unauthenticated actors to assume administrative identities and gain full control of affected WordPress installations. A significant intelligence gap occurred because the plugin's seven product editions share a single identifier (slug), causing premium versions to be omitted from early vulnerability databases while active exploitation was already occurring in the wild. Immediate manual patching and version auditing are required to mitigate risk.