MagicWP

The control layer for WordPress. Platform and infrastructure in one.

[MagicWP @magicwp_io]

First month free on MagicWP Starter, $0 charged, free migration from your current host, cancel anytime before renewal. Same infrastructure and SLA as our paid plans, so you're testing the real thing, not a demo.

https://t.co/DHmFNl2B0w

[MagicWP @magicwp_io]

Elementor 4.3.0-4.3.1 CSRF flaw (CVE-2026-62062), fixed in 4.3.2.

→ One crafted link, opened by a logged-in admin, creates a new admin account
→ The bug disables WordPress's REST API nonce check for every REST route, not just Elementor's
→ CVSS 8.8, live for only about two days before the fix
→ Elementor Pro is affected too, since Pro runs on the free plugin's version
→ Fix: update Elementor to 4.3.2

https://t.co/Xc2DI4Eks3

#WordPress #WordPressSecurity

[MagicWP @magicwp_io]

WordPress 7.1.2 fixes CVE-2026-87902, a critical unauthenticated path traversal affecting every release from 4.7.0 through 7.1.1.

→ CVSS 9.2
→ Lets attackers load local PHP files outside the active theme
→ Can become RCE when the theme and PHP configuration line up
→ 7.1.1 is still vulnerable, with no official workaround

Update now.

https://t.co/2Pw9LuGs9t

#WordPress #WordPressSecurity

[MagicWP @magicwp_io]

Comment2Shell (CVE-2026-93485): an anonymous blog comment that becomes server code execution, fixed in WordPress 7.1.1.

→ Unauthenticated stored XSS in core's wpautop() function, CVSS 7.1
→ Payload goes in through the normal comment form and passes WordPress's content filters
→ Only exploitable on sites using a block theme (or classic theme calling the_content())
→ If an admin views the comment, the script can escalate to a full shell
→ Fix: update to WordPress 7.1.1

https://t.co/o9mkQyMgyW

#WordPress #WordPressSecurity

[MagicWP @magicwp_io]

Click2Shell: WordPress core flaw fixed in 7.1.1.

→ A crafted link, opened by a logged-in admin, force-installs a WordPress theme
→ Root cause: a selector-injection bug in the theme installer's JS
→ Alone: High severity (CVSS 7.1), installs a real theme only
→ Chained with a theme flaw: full remote code execution
→ No CVE yet, no known exploitation in the wild
→ Fix: update core to 7.1.1 or your branch's patched release

https://t.co/8o2XmdTiue

#WordPress #WordPressSecurity

[MagicWP @magicwp_io]

WordPress 7.1.1 shipped with 11 security fixes, most notably CVE-2026-93485, an unauthenticated stored XSS via the comment form. If you tested the RC, you only saw the bug fixes, not the security patches. Update now.

https://t.co/RLIcFKmBQD

#WordPress #WordPressSecurity

[MagicWP @magicwp_io]

WordPress now auto-scores every plugin release during its cooldown and blocks high-risk ones before distribution, covering auto-updates, the update button, and WP-CLI. It doesn't fast-track security patches, even critical fixes wait.

https://t.co/1fpm9IzHfl

#WordPress

[MagicWP @magicwp_io]

This month's MagicWP update: staging sites (full copy of your live site, push to live in one action), one-click Cloudflare setup, and a Database page that finds reclaimable space and cleans it up without a plugin.

https://t.co/0GwjfUcQF9

#WordPress #WordPressHosting

[MagicWP @magicwp_io]

Two miniOrange SAML SSO CVEs let unauthenticated attackers log in as admin. The plugin has 7 separately versioned editions under one slug; advisories covered only the free one, so paid installs can look patched when they aren't.

https://t.co/ZyU8xtVLHp

#WordPressSecurity #CVE

[MagicWP @magicwp_io]

TranslatePress 3.3.4 fixes an unauth stored XSS reachable through the comment form, on 400,000+ sites. Called account takeover because injected JS in an admin session can create a new admin. Update, then audit existing comments.

https://t.co/64sgNDIuPp

#WordPressSecurity #XSS

[MagicWP @magicwp_io]

Elementor Pro's changelog barely mentioned CVE-2026-32475 (unauth upload to RCE), and its exposure claim to customers was narrower than what Patchstack and Wordfence found. It also doesn't auto-update from WordPress.

https://t.co/4VySlRq8wm

#WordPressSecurity #CVE

[MagicWP @magicwp_io]

Site white after updating to WordPress 7.1 and running WP Rocket? It's a TypeError in WP Rocket's Cloudflare module, which loads on every request whether you use Cloudflare or not. Fix: update to WP Rocket 3.23.2.2.

https://t.co/wOnt6OVs6I

#WordPress #WPRocket

[MagicWP @magicwp_io]

CVE-2026-19598 hits Pods 2.8-3.3.9 (100k+ sites): its AJAX handler logs failed access checks instead of blocking them, so unauthenticated requests get through. CVSS 9.8. Deactivating isn't enough, update or delete.

https://t.co/6ZQcH3mOgR

#WordPressSecurity #CVE

[MagicWP @magicwp_io]

CVE-2026-32475 lets unauthenticated visitors upload PHP via Elementor Pro's Forms File Upload field (≤4.2.1, CVSS 9.0). Update to 4.2.2, then check uploads for anything that isn't a doc or image. We broke it down on the blog.

https://t.co/7i0UQ7cZcg

#WordPressSecurity #CVE

[MagicWP @magicwp_io]

CVE-2026-15748 lets unauthenticated visitors upload PHP via Forminator (≤1.56.1), but it only bites if a form pairs File Upload with Select, and PHP can run in your uploads folder. We broke down how to check exposure and patch.

https://t.co/55RyxC3stE

#WordPressSecurity #CVE

[MagicWP @magicwp_io]

Web fonts hurt LCP and CLS in different ways, and font-display alone won't fix both. We cover crossorigin preloading, metric overrides to stop layout shift, and how WordPress's Font Library lets you self-host it all.

https://t.co/wUJTCe2Unl

#WordPress #WebPerformance

[MagicWP @magicwp_io]

WordPress has an official browser extension now.

It puts the admin bar in your toolbar, so you can hide it on the front end and still jump into the editor. No telemetry, nothing leaves your machine.

What it does and where it stops: https://t.co/2v4bjzppoI

[MagicWP @magicwp_io]

WordPress 7.0.4 patches CVE-2026-65640, an Author-level RCE that only bites if your server runs Imagick + Ghostscript. We broke down how to check your exposure and update safely on the blog.

https://t.co/QRXd0pvH85

#WordPressSecurity #CVE

[MagicWP @magicwp_io]

If you're setting up transactional email for WordPress, the guide above walks through @resend, @postmarkapp, @Mail_Gun, @useplunk, and @Mailtrap, plus the SPF/DKIM/DMARC steps most tutorials skip.

[MagicWP @magicwp_io]

Password resets vanishing? Order confirmations landing in spam? Your WordPress site probably isn't authenticating its email. Here's how to fix it with an API instead of SMTP.

https://t.co/mDXHAaRYy0

#WordPress #WooCommerce #EmailDeliverability