• WordPress patches two flaws: CVE‑2026‑60137 (SQL injection, medium severity) and CVE‑2026‑63030 (REST API batch‑route confusion, critical severity)
• When chained, the bugs enabled unauthenticated remote code execution, allowing full site takeover
• Admins should urgently upgrade to WordPress 6.9.5 or newer to protect against widespread active attacks

Millions of WordPress websites could be at serious risk, researchers are warning, due to two recently patched vulnerabilities that are being actively exploited in the wild.

WordPress developers released a patch for two vulnerabilities - an SQL injection bug tracked as CVE-2026-60137, and a REST API batch-route confusion bug, tracked as CVE-2026-63030.

The former is a medium-severity, 5.9/10 vulnerability affecting WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2, while the latter is a critical-severity, 9.8/10 flaw affecting versions 6.9.x before 6.9.5 and 7.0.x before 7.0.2 of the world’s most popular website builder.

Exploitation underway

According to The Register, these bugs are not that dangerous when looked at separately, since they are rather difficult to exploit. However, when chained together, they allow unauthenticated threat actors to execute malicious code remotely, which means full website takeover.

Security researchers at Knott say threat actors picked up on the scent rather quickly.

The patch was released on Friday, but “by the early hours of Saturday morning, successful exploitation was already well underway, initially using public exploit code to exfiltrate hashed credentials, with remote code execution following once additional details were made public,” Knott said.

“From our vantage point across a global client base, we are seeing widespread impact of this vulnerability across organizations of every size and every vertical.”

It is worth mentioning that these vulnerabilities affect WordPress directly, instead of different plugins or themes. WordPress is by far the most popular website builder platform in the world, powering more than half of all websites in existence today.

To protect your assets, make sure to upgrade WordPress to version 6.9.5, since it contains fixes for both flaws.

The internet is undergoing a major shift, with publishers, ecommerce platforms and everyone in between struggling to grow visibility and remain relevant in an AI-dominated era.

Today, AI overviews and summaries dominate traditional search, while agentic assistants autonomously browse the web for consumers who have already shifted their browsing habits to their favorite chatbot.

But for decades, the web has been designed for human visitors, with search engines acting as intermediaries that help direct human traffic toward specific web pages. With more and more online content now being consumed by machines and AI taking over the decision of which information and products reach consumers first, traditional SEO alone is over.

GEO, or generative engine optimization, is already a term that publishers are throwing around, but few are certain of what it means and how they should balance it with their SEO strategies.

Publishers need to target two audiences… but humans are no less valuable

According to new data from WordPress VIP, nearly three in four enterprise decision-makers now consider AI discoverability and attribution a significant priority, with three in five seeing increased traffic from AI search engines and third parties – so the shift is well underway, and companies are already starting, or trying, to adapt.

Per the report, nearly twice as many enterprise decision-makers now plan to prioritize investments across social platforms (32%) and AI engines (30%) compared with conventional owned websites (17%).

But amid this machine revolution, consumers are still pressing for human connections, with nearly half (42%) saying they trust unattributed AI-generated answers less than the likes of confusing privacy policies.

Today, publishers face a battle between AI optimization and visibility, and personalization and human-ness.

But WordPress VIP isn’t too concerned about the challenges, seeing them as temporary and familiar. CTO Brian Alvey even believes they mirror previous shifts brought on by social media.

So to understand what this AI revolution means for publishers, brands and the future of the web in general, I sought advice directly from Alvey.

• Brian, the report you published mentioned that online properties like TechRadar need to serve two masters: AI scrapers and human audience. How is that being done in real life by brands that are looking to juggle both?

For decades, we’ve all built websites for Google. Sure we write for other people, but we format content for search engines and social networks. But Google and social were just top of funnel sources for getting visitors to your site. But now there's an actual second audience.

Our more innovative customers are already building sites for both humans and agents. And they’re doing it in the block editor. The same way you can tell a three-column block to reformat and stack the content for display on mobile, these customers are making content blocks that reformat as markdown for agents. Now all of their data-filled interactive charts are no longer just for a human audience. Their content is agent-native. And the wild thing that’s happening as they make their content easier for AI agents to understand is that they’re seeing a lift in SEO.

And this totally new version of their website isn’t doubling their work. It’s just built into their workflows.

The website is no longer just a destination for people. It has already become a source of information for machines acting on behalf of people. And the sites that aren’t simple for agents to consume will effectively be invisible to this new half of the internet. Companies that can serve both human and agent audiences will be the ones that survive.

• One fact that caught my eye was that the majority of consumers trust unattributed AI answers with a huge portion (86%) bothered by searching for the original source after scanning an AI summary. What do you make out of it? How does the future look through that lens?

This might sound crazy with all the fear and hate AI is getting these days, but AI might actually be the best thing that ever happened to trusted brands. When an answer engine chooses you as a source, that's a powerful endorsement. Sure, the clicks might not be there right now, but the credibility boost sure is. We've been worrying that AI would cut brands out of the conversation. What our data shows is that the brands people already trust are the ones AI keeps going back to.

Your goal has never changed: be the most trusted business in your space. In an AI world, that trust will get you cited. And the brands that get cited will be the only ones that still exist for customers when the AI answer engines fully take over the internet.

• Another finding from your report that shocked me was that only 17% of enterprises in the report will prioritize investments in their own websites in 2027. It's shocking as it means that instead, they will rely on social media and search engines to bring in audience. What are your thoughts about this?

That 17% number shocked me too. Did all these companies learn nothing from search and social? It’s not surprising that marketing teams are chasing where the audiences are going. But that means they’re giving up on having strong direct relationships with their customers. Being satisfied with getting roughly 60% of your audience reach from third-party platforms isn’t healthy. That's a lot of dependency on platforms you don't control.

Even if you use email as your primary channel of communication, which is a fantastic direct connection to your audience and customers, you still can’t process a sale or sign up a new subscriber in an email message. Your website still matters. The companies that win will be the ones that treat AI, social and search as distribution channels while continuing to invest in customer experiences they own and can constantly improve.

• 35 years ago, the open web was merely a pipe dream. CompuServe, AOL and a bunch of other gated communities dominated the landscape. Fast forward to 2026 and it seems that we're gradually slipping into an era where the open web - as we know it - is set to disappear. Tech giants are "encouraging" audiences to produce and consume content on their proprietary platforms. Is it too late to do anything?

No, I don't think it's too late. If you look at the history of the internet, we've gone through versions of this before. Thirty years ago you only had closed systems, which were a great first step for getting the world online. The web opened things up, but then search and social became the new gatekeepers. AI is creating another layer of gatekeepers but what's different this time is that we’re ready.

The consumers we talked to crave attribution. They care strongly about open access to information. They need to know where the answers they’re getting come from. The web won’t disappear, but it does need to evolve. These are the conversations we have every day with the people who run the world’s biggest and most important websites. We all agree that the only thing that matters is whether publishers, creators, and brands can maintain a direct relationship with their audiences and customers as these new pathways emerge.

• The general consensus is that the web (and our email infrastructure) we know wasn't built for AI. I remember the days of Web 1.0, Web 2.0 and Web 3.0. Are we already in the Web 4.0 era? How do you evolve this hybrid ecosystem bearing in mind what we discussed in Q1 and the previous one?

Because we’ve been through this before with the rise of search and the rise of social and the big “pivot to video,” we’ve never been more prepared to adapt. The difference this time is the speed and the scale. While search and social disrupted the top of the marketing and sales funnels, AI agents are disrupting nearly the entire funnel. And the disruption won’t be slow this time. Agents are crawling sites at rates that are orders of magnitude bigger than search and social combined. And agents are disrupting every facet of websites, from creation all the way through to consumption. It’s total disruption. The good news is that your business hasn’t changed. What you make and who you make it for hasn’t changed. But how you make it and how they buy it has changed for good. If AI is 80% threat and 20% opportunity, then your job is to dive into that 20% and make AI work for you.

• Your study indicates that the average internet user hits "bot fatigue" in just 40 minutes, and almost three-quarters of the respondents say the internet is significantly less human than it was a decade ago. Can anything be done to change that course or it is just too late, meaning we have to just go with the flow.

In some ways, we’re never going back. AI is already part of every product and every workflow. The good news is that the fatigue you mentioned and all this distrust are reversible, but only for the brands willing to actually be human about it.

A certain volume of AI content is expected now. There is no excuse to publish slowly anymore. But what’s missing from that AI-boosted content production? Specificity is what’s missing. A real take, a weird opinion, someone who you can tell actually knows what they're talking about. The brands cutting through the fatigue are the ones with actual voices, not mindless content machines. I'd rather read one paragraph from someone who's lived it than ten paragraphs of well-organized AI vanilla bullet points. That's what people are hungry for. The antidote to bot fatigue is just humans being human.

• Vulnerability in UpdraftPlus plugin on Awesome Motive’s marketing server enabled CDN compromise and malicious JavaScript injection
• Malware targeted logged‑in WordPress admins, harvesting tokens and creating rogue accounts for full takeover
• Site owners urged to check for fake admin accounts (‘developer_api1’, ‘dev_xxxxxx’), hidden backdoor plugins, and rotate credentials/security salts

More than a million WordPress websites were at risk of full website takeover, after a vulnerability in a plugin enabled a large-scale supply-chain attack. The attack was spotted over the weekend by the ecommerce security outfit Sansec, and later confirmed by the victim company.

According to the researchers, hackers found and exploited a vulnerability in the UpdraftPlus WordPress plugin running on a marketing server belonging to Awesome Motive, the company behind multiple popular WordPress products including OptinMonster, TrustPulse, and PushEngage.

Even though the vulnerable server was not part of the production environment, it stored credentials for the company’s content delivery network (CDN), and by using the stolen CDN API key, the attackers were able to modify JavaScript files distributed through Awesome Motive's CDN.

Targeting admins only

The compromised files were later used by OptinMonster, TrustPulse, and PushEngine, meaning the attackers’ JavaScript was served to visitors, but not all of them.

The malware only activated when a logged-in WordPress admin visited an affected site, helping it remain hidden while targeting only high-privilege users. The malicious script then harvested administrator authentication tokens and WordPress nonces, using them to create new admin accounts.

In the next step, the attackers installed additional malicious plugins, established command-and-control infrastructure, and began exfiltrating sensitive data. The malware also enabled web shell functionality, arbitrary PHP code execution, file management features, and virtually anything else an admin might do.

Even after Awesome Motive removed the malicious CDN scripts, attackers retained control of already compromised websites through the rogue administrator accounts and hidden backdoor plugins. Therefore, website owners at risk of takeover should look for rogue admin accounts named ‘developer_api1’ or ‘dev_xxxxxx’, inspect the filesystem directly under wp-content/plugins for hidden backdoor plugins, and execute server-side malware scans.

Furthermore, they should rotate admin passwords, API keys, database credentials, and WordPress security salts.

Via BleepingComputer

• Critical RCE flaw in Everest Forms Pro (CVE‑2026‑3300) actively exploited
• Attackers create rogue admin account “diksimarina” via PHP injection
• Nearly 30,000 takeover attempts blocked; admins urged to patch and block key IPs

Security researchers are warning of an ongoing hacking campaign targeting certain WordPress websites using a popular plugin tool.

Wordfence has claimed Everest Forms Pro, a popular WordPress plugin, was allegedly being used to create contract, registration, payment, and other application forms, carried a critical-severity vulnerability that allowed malicious actors to take over the sites entirely.

The bug was described as a Remote Code Execution (RCE) flaw via PHP code injection. It is tracked as CVE-2026-3300 and was given the severity rating of 9.8/10 (critical). It affects all versions of the plugin up to, and including, 1.9.12.

Patched months ago

Wordfence is now warning that the flaw is being actively abused in the wild to create malicious admin accounts on vulnerable websites:

“The attacker submits a value for a text field that begins with a single quote to close the wrapping string literal, followed by a PHP statement that calls wp_insert_user() to create a new administrator account with the username 'diksimarina’,” Wordfence warned in its report.

“The trailing // comment marker ensures the rest of the generated PHP code, including the closing quote, is treated as a comment and does not cause a syntax error.” “When the form is processed, and the calculation is evaluated, the injected PHP code is executed, and the malicious administrator account is created.”

By creating an admin account, malicious actors can do almost anything with the website, including exfiltrating stored files, redirecting visitors, or even serving malware.

The bug was first disclosed in February this year, and by mid-March, the Everest Forms developer released a fix. Wordfence says that exploitation attempts started roughly a month later, in mid-April. So far, it thwarted almost 30,000 attempts, most of which came from two IP addresses.

Admins worried about being potential targets should block the two IP addresses 202.56.2[.]126 and 209.146.60.26, and should review log files for the string “diksimarina.”

Via BleepingComputer

It’s a tempting comparison. WordPress gave a generation of creators a way to publish without needing to understand code. Shopify has done something similar for commerce, turning what was once complex, expensive and developer-led into something far more accessible.

But while the parallels are real, the story is a little more layered than a straight one-to-one.

WordPress didn’t just win because it was good. It won because it made the internet feel usable. You could set up a site quickly, choose from thousands of themes, and rely on a vast community to solve problems as they came up.

It lowered the barrier to entry so effectively that it became the default. If you wanted to exist online, WordPress was where you started.

Shopify has taken that same principle and applied it to selling. It has removed the friction from getting started. Payments, hosting, storefront design and checkout are all built in. You do not need a technical background to launch a store. You do not need a large budget to begin testing an idea.

That accessibility has changed the shape of retail, particularly for independent brands and smaller merchants who previously would have been locked out of the market.

An ecommerce ecosystem

But what really makes the comparison stick is the ecosystem. Shopify has not just built a platform. It has built an economy around that platform. Thousands of developers work inside Shopify.

Tens of thousands more build apps, themes and integrations around it. Agencies have reshaped themselves to specialize in it. An entire layer of commerce expertise now exists because Shopify made it viable.

Shopify now powers millions of merchants globally, with a partner ecosystem of over 100,000 companies and more than 16,000 apps extending core functionality. It’s effectively become a default stack for commerce, lowering the barrier to entry and accelerating a wave of agencies building on the same foundations.

Shopify accounts for ~30% of ecommerce platforms globally – and it’s one of the tech stories of recent years.

That creates a kind of gravitational pull. The more people build on it, the more useful it becomes. The more useful it becomes, the more people choose it. WordPress followed the same path. Over time, it became less of a tool and more of an infrastructure layer for the internet.

Shopify is moving in that direction for commerce. It is also increasingly positioned as the fastest route into building a “tech-enabled” business. A brand can launch on the same platform used by global retailers, access a marketplace of thousands of apps, and plug into multiple sales channels without needing to rebuild its core systems.

That sense of shared infrastructure is powerful. It means smaller businesses can operate with the same underlying capabilities as much larger ones.

This is where the comparison becomes more interesting, and more complicated. WordPress simplified publishing, but it did not eliminate complexity.

It redistributed it. Hosting, plugins, performance and security all became areas where expertise still mattered. Shopify is doing something similar, but the complexity it redistributes sits in a different place.

It’s a little more complex

In commerce, the real challenge is less about launching a new website or store and more about connecting. What used to sit in custom development now sits in integration, orchestration and data flow.

A brand might have a storefront, a warehouse system, a CRM, a returns platform, a loyalty program and multiple marketplaces. Each of these systems needs to talk to the others. Each needs to stay in sync. Each needs to respond in real time to customer behavior.

That is where the pressure has moved. It is also where many businesses begin to struggle. The front end is easy to launch. The back end is where things either scale or break. Integration has been a consistent challenge across decades of ecommerce.

Every project eventually comes back to the same question. How do you connect systems in a way that is reliable, scalable and commercially viable?

This is not something WordPress had to contend with at the same level. Content is relatively simple compared to commerce. Selling involves inventory, fulfilment, pricing, tax, payments and increasingly personalization. Each layer adds complexity, and each connection introduces potential points of failure.

So while Shopify has lowered the barrier to entry, it has not removed the need for technical thinking. It has simply shifted where that thinking happens.

This shift is already shaping how brands compete. When many businesses are built on the same platform, differentiation becomes harder. If everyone can launch quickly and access similar tools, the advantage no longer sits in getting online. It sits in how well everything works together once you are there.

That includes how data flows across systems, how quickly operations can adapt, and how consistent the customer experience feels across channels. It also includes how brands use that data to drive retention, not just acquisition. The focus is moving away from launch and towards long-term performance.

Shopify is responding to this by evolving beyond a pure ecommerce platform. Its investment in POS, marketplaces and channel integrations points towards a broader vision of unified commerce. The aim is not just to help brands sell online, but to help them sell everywhere in a connected way.

That ambition is significant. It suggests Shopify does not just want to be the WordPress of commerce. It wants to be the operating system for retail. There are early signs of that playing out. Brands we work with using Shopify as part of a wider ecosystem that spans online, in-store and global expansion.

The platform is no longer just a starting point. For many, it becomes a central layer in how the business runs.

The role of AI

At the same time, Shopify is embedding AI tools into its platform, which further lowers the barrier to entry. Tasks that once required specialist knowledge are becoming automated or assisted.

Product descriptions, merchandising decisions, customer insights and even aspects of development are being simplified. This mirrors the way WordPress plugins and tools made content creation more intuitive over time.

But again, the complexity doesn’t disappear, it evolves. AI increases the need for clean, accessible data. It increases the importance of having systems that can respond quickly and accurately. It also raises the stakes for integration, as more processes become automated and interdependent.

If one part of the system fails, the impact can ripple much further.

That question again

So is Shopify the new WordPress? In some ways, yes. It has democratized access to a core digital capability. It has built a vast ecosystem. It has become the default starting point for a generation of businesses. But it is also operating in a more complex environment, where the challenges do not end at launch. They begin there.

WordPress gave people a voice online. Shopify has given people the ability to sell. The next phase is about what happens after that moment. How businesses connect, scale and differentiate in a world where the tools are increasingly the same. That is where the real competition sits now.

And it is why Shopify’s position, while strong, is not unassailable.

Its lead comes from momentum, ecosystem and ease of use. But as commerce becomes more composable, more data-driven and more dependent on integration, the centre of gravity may shift again. The platform still matters, but it is no longer the whole story.

Shopify may be the closest thing commerce has to a WordPress moment. But what comes next will be defined less by how easy it is to start, and more by how well everything works together once you do.

We've featured the best ecommerce hosting.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Malware hides payload in Steam Community comments
• WordPress sites used to host backdoors
• Nearly 2,000 sites compromised since July

Security researchers from GoDaddy found a cheeky new malware campaign that used comments made by Steam Community accounts as command-and-control (C2) infrastructure.

Here is how the attack plays out: The attackers would first find vulnerable WordPress websites, or those protected by weak credentials, and use them to host PHP malware somewhere in the site’s files. For example, the sample was found in a theme’s ‘functions.php’ file. This malware contains both a JavaScript injection component, and a server-side backdoor.

Then, whenever a visitor loads the infected website, the malware contacts one of several Steam Community profiles and downloads the contents of profile comments. On surface level, these comments look harmless (albeit incoherent), but they also contain invisible Unicode characters which carry the actual payload.

Industry support

“This encoding allows binary data to be embedded within normal-looking text. The visible characters serve as camouflage while the invisible characters carry the actual payload,” GoDaddy said.

The malware then extracts the characters, converts them into binary data, and reconstructs the original bytes. The researchers found that this recovered data contains a URL controlled by the attackers, which points to a domain hosting a JavaScript file spoofing a legitimate library.

The malware then uses WordPress to load the attacker-controlled JavaScript on every frontend page, which the visitors’ browsers then download and run, infecting themselves in the process.

In the campaign, there are two sets of targets - vulnerable WordPress websites, and their visitors. Since uncovering the campaign in July last year, GoDaddy said it found almost 2,000 compromised WordPress sites. Unfortunately, the research report stops short of describing what the malware does to visitors.

If you run a WordPress website, GoDaddy recommends to check for references to Steam Community URLs, external JavaScript injections, as well as outbound connections from WordPress to Steam.

Via BleepingComputer

• Researchers disclosed a critical flaw in WP Maps Pro allowing attackers to create hardcoded admin accounts
• Exploitation is active: Wordfence blocked over 3,600 attempts in a single day
• Patch released May 20 (v6.1.1); users must upgrade immediately

Criminals are actively exploiting a critical vulnerability in a popular WordPress plugin to create admin accounts and thus take over entire websites. This is according to multiple security researchers including David Brown (who first disclosed the flaw), and Defiant, who confirmed in-the-wild exploitation attempts.

The plugin in question is called WP Maps Pro, it is a premium WordPress plugin used to create customizable maps, interactive store locators, and similar, using either Google Maps or OpenStreetMap. The plugin is currently used by more than 15,000 websites, according to Envato Market numbers.

As per Brown’s research, the plugin suffered from a “privilege escalation via administrator account creation” vulnerability which allowed threat actors to create a new WordPress user with a hardcoded admin role. The vulnerability is now tracked as CVE-2026-8732, and carries a severity score of 9.8/10 (critical). It was found in versions 6.1.0 and older.

Applying a fix

Defiant, the cybersecurity company behind Wordfence, said its researchers observed and stopped more than 3,600 exploitation attempts in just one day.

“When the request is made with a check_temp parameter set to false, the function creates a new WordPress user via wp_insert_user() with the hardcoded role of administrator, a randomly generated username, and the hardcoded email address support@flippercode.com,” the researchers said. “The function then generates a “magic login URL” using generate_login_link(), stores it as user meta, and returns it in the response body.”

The fix was released four days after initial disclosure, on May 20. Users are advised to upgrade to version 6.1.1 as soon as possible to avoid being targeted.

With WordPress powering much of today’s internet, it is also one of the most targeted platforms in existence. Its vast ecosystem of plugins and themes, both free and premium, are constantly being abused in attacks such as this one.

Via BleepingComputer

• Hackers are exploiting a critical flaw in the Funnel Builder plugin to inject credit card skimmers into checkout pages
• FunnelKit released a patched version, but more than half of active sites remain on older, vulnerable builds
• Stolen payment data is being monetized through dark web sales and fraudulent ad purchases

Hackers are exploiting a critical vulnerability in a popular WordPress plugin to steal credit card information from people making online purchases.

Security researchers Sansec said they recently spotted an active campaign targeting websites running the Funnel Builder plugin, which is apparently active on more than 40,000 ecommerce websites, letting businesses create sales funnels, landing pages, optimized checkout flows, upsells, and lead-generation campaigns, all without any coding.

Sansec found it carried a critical-severity vulnerability (no CVE yet), that allows threat actors to add malicious JavaScript snippets into WooCommerce checkout pages, without authentication. According to the researchers, someone used it to add a credit card skimmer capable of exfiltrating credit card numbers, CVVs, billing addresses, and other customer information.

Patching the flaw

We don’t know how many websites have been compromised this way, or how many people lost their credit card information to the hackers - however, the data they stole is all they need to make fraudulent purchases online.

In most cases, though, they just sell it on the dark web to the highest bidder. Usually cybercriminals use stolen cards to purchase ads on reputable ad networks and promote malware that can lead to ransomware infections.

Most of the ads for malware and infostealing landing pages seen on Google are paid for with stolen credit cards and through compromised Google Ads accounts.

Since then, FunnelKit (the company behind the plugin) addressed the issue and released a new version - 3.15.0.3. All users are advised to upgrade to this version and secure their websites immediately.

At press time, the official WordPress site shows 50.3% of all websites are running older versions of Funnel Builder, meaning at least 20,000 sites are directly exposed. The remaining 49.7% are shown as running version 3.15, so we don’t know how many have patched up. Therefore, number of websites at risk could possibly be even higher.

Via BleepingComputer

• Wordfence disclosed two flaws in Avada Builder, a WordPress plugin with around 1 million active installs
• CVE‑2026‑4782 (Arbitrary File Read, medium severity) requires subscriber‑level access; CVE‑2026‑4798 (SQL injection, high severity) exploitable unauthenticated
• Patches released in April and May 2026; users advised to update to v3.15.3+; researcher Rafie Muhammad earned ~$4,500 bounty

A popular WordPress plugin with roughly a million active installations contained two vulnerabilities that could have allowed malicious actors to exfiltrate sensitive data, such as password hashes and other valuable information.

Security researchers at Wordfence said they were tipped off by a researcher Rafie Muhammad about the existence of an Arbitrary File Read and an SQL Injection vulnerability in Avada Builder.

Avada Builder is a drag-and-drop page builder for WordPress that comes as part of the Avada ecosystem by ThemeFusion, with more than 1,050,000+ active installations right now. With it, users can build websites without needing to learn or write code. It works by dragging and dropping different elements like text blocks, images, sliders, buttons, forms, pricing tables, and layouts onto a page, and customizing them in real time.

Patches available

The only prerequisite to be able to exploit the first bug is to have at least subscriber-level access, which shouldn’t be too difficult on most sites. This bug, now tracked as CVE-2026-4782, was assigned a severity score of 6.5/10 (medium).

The SQL injection vulnerability, on the other hand, can be exploited even by unauthenticated attackers, to extract sensitive data from the database, including hashed passwords. This one is now tracked as CVE-2026-4798 and was assigned a slightly higher severity score - 7.5/10 (high).

Wordfence said the flaws were disclosed to the Avada team on March 24 and 25, 2026, and the developers came back with patches within two months - one on April 13, and the other on May 12.

Users running Avada Builder on their website are advised to update the plugin to version 3.15.3 or newer as soon as possible.

Muhammad was paid roughly $4,500 in bounty for his troubles, Wordfence confirmed.

"Props to Rafie Muhammad who discovered and responsibly reported these vulnerabilities through the Wordfence Bug Bounty Program," it wrote in its report.

"Our mission is to secure WordPress through defense in depth, which is why we are investing in quality vulnerability research and collaborating with researchers of this caliber through our Bug Bounty Program. We are committed to making the WordPress ecosystem more secure through the detection and prevention of vulnerabilities, which is a critical element to the multi-layered approach to security."

• Clean Markdown delivery cuts AI processing waste and lowers large scale computing loads
• Global WordPress adoption could shrink billions of gigabytes of unnecessary data transfers
• Estimated energy savings rival electricity needed to briefly power the United States

A new open source WordPress plugin focuses on the growing load created by AI systems constantly crawling websites and processing pages never built for machines in the first place.

The WordPress Markdown for Agents tool, released by The Chancery Lane Project, serves simplified Markdown versions of webpages when AI agents visit, stripping out scripts, navigation elements, and other extras that machines tend to ignore anyway.

Instead of forcing AI systems to process full HTML pages packed with layout code and styling, the plugin delivers only readable content, cutting token usage and reducing computing demand when bots access supported pages.

Websites are built for humans, not AI

Estimates tied to common webpage sizes and automated traffic patterns suggest the impact could scale quickly if widely adopted across WordPress installations, which account for hundreds of millions of sites globally.

Serving Markdown instead of raw HTML typically shrinks transferred data by around 80%, turning a 2.3MB page into something closer to 0.46MB once layout elements and supporting code are removed.

With conservative estimates placing automated AI visits at roughly 1,000 requests per month per site, each site could reduce transferred data by about 22GB annually when serving simplified content to supported crawlers.

Multiply that across large numbers of WordPress deployments, and total reductions climb into the range of 17.8 billion gigabytes saved each year under those same assumptions.

Energy consumption tied to moving and processing data adds another layer to the discussion, since estimates place average electricity use for data transfer and hosting at roughly 0.81kWh per gigabyte.

Using those figures, total annual energy reductions could reach roughly 14.4 billion kilowatt-hours if adoption spread broadly across WordPress deployments, although real-world totals would naturally depend heavily on traffic patterns and adoption levels.

“If climate action scales through law, then ensuring that legal knowledge can travel effectively in an AI-driven world is essential. Most websites are built for human users, not AI, which means systems often process large amounts of irrelevant data, increasing cost and energy use," said Ben Metz, Executive Director of The Chancery Lane Project.

"For TCLP, this is about maintaining access to high-quality, climate-aligned legal content at a time when the way information is accessed is fundamentally changing. This plugin addresses that by delivering a clean, machine-readable version of content, enabling more efficient retrieval for tasks such as research, drafting, and analysis,” he added.

Early testing cited reductions of up to 90% in token usage when AI systems accessed pages via Markdown delivery rather than full webpage rendering.

“Improving the efficiency of digital systems is not just a technical concern. It has real environmental implications,” said Felix Cohen, the company's Director of Digital.

Building a website has never been easier. Launching one, however, and keeping it running as traffic scales has never been more complicated.

Most modern websites depend on a long list of tools working behind the scenes: hosting IT infrastructure, analytics platforms, marketing integrations, security layers, performance optimization tools, and accessibility checks.

Each one exists for a good reason. Together, they help businesses deliver the fast, reliable experiences customers now expect online.

When everything works as it should, the results can be monumental. A well-built website can load instantly, rank well in search, capture leads automatically, and support marketing campaigns around the clock.

For many businesses, the website has quietly become one of the most important growth engines they have. But getting to that point is rarely straightforward.

Before a site even launches, teams often spend hours installing plugins, configuring integrations, and checking all the tools work together. Performance tools must not conflict with security layers.

Marketing integrations must connect cleanly to analytics systems. Updates must not break the site entirely. What looks simple in theory can become frustratingly complicated in practice.

For many developers, agencies, and businesses, preparing the environment behind a website now takes as much time as building the site itself.

Why modern website stacks became so complex

Part of the reason modern website stacks become so complex is because of 2026’s website expectations. A modern site might need to support ecommerce transactions, run marketing campaigns, track analytics, protect customer data, and meet accessibility standards. Delivering all of this requires specialized tools.

Hosting infrastructure provides the foundation. Content management systems power the site itself. Plugins and integrations extend functionality into areas like SEO, email marketing, analytics tracking, and performance monitoring.

This modular model is one of the web’s greatest strengths. Instead of relying on one system to do everything, businesses can choose the tools that best suit their needs – giving them the technological flexibility needed to compete with enterprise players.

Interestingly, looking at real usage data across more than 100,000 WordPress applications running on Cloudways, most website stacks end up looking quite similar. A small number of tool categories appear repeatedly: SEO plugins, marketing integrations, page builders, accessibility tools, and optimization layers across a huge number of projects.

These tools are popular because they work. But teams often end up rebuilding the same stack repeatedly. Each new project starts with researching plugins, testing integrations, and fixing compatibility issues before the environment becomes stable. The flexibility to mix and match tools makes this possible – but it also adds complexity.

The hidden operational cost of tool sprawl

That complexity usually shows up in day-to-day operations. Teams spend more time maintaining the website environment than improving the site itself. Plugins need updating. Integrations need monitoring. Performance issues need investigating.

For agencies managing dozens of client websites, or ecommerce teams responsible for high-traffic stores, this maintenance work adds up quickly.

Troubleshooting can also become difficult. When a site slows down or experiences downtime, the cause is rarely obvious. The issue might come from server configuration, plugin conflicts, database queries, or external services. With multiple systems involved, identifying the root cause can take time that most businesses don’t have.

Security creates another layer of work. Every integration introduces another component that needs monitoring and updating. Keeping everything secure and compatible requires consistent attention, especially for teams without dedicated infrastructure specialists.

None of these tasks are unusual. The challenge is how many of them accumulate over time.

How businesses can simplify their website infrastructure

The answer is not removing tools entirely. The flexibility of the web ecosystem is essential to a successful website. Instead, businesses need to manage their stacks in ways that reduce unnecessary complexity.

A strong hosting foundation is a good place to start. Managed hosting platforms that handle server management, monitoring, and performance optimization can remove a large amount of operational work.

When web hosting environments include automated diagnostics and monitoring, teams can identify issues earlier and resolve them faster. Many hosts also surface trusted integrations and partner tools, helping teams extend their stack without starting the research process from scratch.

It also helps to rely on proven tools. Despite the vast number of plugins available, most successful websites rely on a relatively small group of well-established solutions. Using widely adopted tools reduces compatibility risks and makes maintenance easier.

Regularly reviewing the stack is equally important. Websites often accumulate duplicate plugins performing similar tasks. Removing redundant tools can simplify the environment and improve performance at the same time.

Finally, compatibility matters. Tools designed to work well together dramatically reduce troubleshooting. Platforms that test and validate integrations before deployment can save teams considerable time during setup.

Simplicity is becoming a competitive advantage

Websites will only become more capable as new technologies emerge. But as the ecosystem grows, the ability to manage complexity becomes more important.

Businesses that simplify their website infrastructure can launch projects faster, maintain performance more easily, and respond to problems before they affect customers. Instead of spending time maintaining tools and fixing integrations, teams can focus on improving the website experience itself.

In an online environment where performance directly affects trust, engagement, and revenue, that shift matters. The future of web infrastructure may not depend on how many tools businesses can add to their stack, but on how well the right tools work together from the start.

We've ranked the best website builders.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• User Registration & Membership plugin flaw allows attackers to gain admin access without login
• Exposed nonce values enable unauthorized backend requests and privilege escalation
• Sensitive user data becomes exposed once administrative privileges are obtained

A critical security flaw in a widely used WordPress plugin allows unauthenticated attackers to bypass authentication controls and gain full administrative access to affected websites.

The vulnerability, tracked as CVE-2026-1492, affects the User Registration & Membership plugin, versions 5.1.2 and earlier.

Experts at Cyfirma say improper server-side validation and weak authorization checks within the membership registration workflow create this dangerous gap.

How attackers exploit the vulnerability without any credentials

Attackers can abuse exposed client-side data and insufficient backend validation to manipulate parameters that directly influence authentication and privilege assignment.

The vulnerability stems from trusting user-controlled input rather than enforcing strict server-side validation.

Backend endpoints process membership-related actions without proper authentication or authorization checks.

This weakness becomes dangerous because exposed nonce values within client-side JavaScript are accessible to unauthenticated users.

Attackers can then reuse these nonce values in crafted requests to manipulate backend behavior, even for website builders.

By inspecting these values, attackers can construct malicious requests targeting the WordPress AJAX endpoint at /wp-admin/admin-ajax.php.

The backend processes these requests without verifying the request origin or authorization state.

This results in automatic authentication and privilege escalation, where administrative access is granted without any legitimate login process taking place.

Successful exploitation grants attackers unrestricted administrative privileges over the entire WordPress environment.

With this level of access, attackers can install malicious plugins and modify themes to execute arbitrary code.

They can also access sensitive user data, including credentials and configuration files.

Hidden admin accounts can be created to ensure persistent access even after initial detection.

These attackers can also redirect website visitors to phishing pages or malware distribution sites.

Website defacement, content tampering, and malicious script injection become trivial once administrative control is established.

All versions of the User Registration & Membership plugin up to and including version 5.1.2 are vulnerable to this flaw - but the issue has been addressed in version 5.1.3 through improved validation and authorization mechanisms — so website administrators must update immediately.

After updating, administrators should review existing user accounts, especially those with administrative privileges, which will help identify any unauthorized accounts created before patching.

Suspicious sessions should be invalidated, and credentials reset if compromise is suspected.

The vulnerability carries a CVSS v4.0 score of 9.8 out of 10, indicating critical severity.

Observed discussions in underground forums show active interest in exploiting this vulnerability.

Hackers are already sharing exploitation techniques among themselves and discussing automation strategies.

Initial Access Brokers may leverage this flaw to obtain administrative access and resell it for ransomware deployment, SEO spam campaigns, or credential harvesting operations.

Given the low complexity of exploitation and public awareness of the technique, website owners running the affected plugin should treat their systems as actively at risk and prioritize remediation immediately.

• Malicious actor bought 31 WordPress plugins from Essential Plugin
• Updates injected backdoors, granting full site access
• Spam campaigns hidden from owners, C2 resolved via Ethereum smart contract

A hacker bought more than 30 legitimate WordPress plugins and abused their good standing to infect tens of thousands of websites with backdoors.

Austin Ginder, founder of Anchor Hosting, reported how a client recently alerted him of a known plugin suddenly allowing unauthorized third-party access. The investigation led him to a somewhat troubling discovery: a company that developed 31 WordPress plugins, both free and premium versions, was sold in early 2025, to a person calling themselves “Kris”.

That person then added malicious code to all plugins and pushed the update to the WordPress websites actively using them.

Injecting sophisticated code

The malicious company is called Essential Plugin, and claims its products have been installed more than 400,000 times and were being actively used by more than 15,000 customers. The official WordPress repository shows more than 20,000 active WordPress installations.

The malware was essentially a backdoor that granted the attacker full access to the websites. The goal seems to have been to propagate existing spam campaigns:

“The injected code was sophisticated,” Ginder explained. “It fetched spam links, redirects, and fake pages from a command-and-control server. It only showed the spam to Googlebot, making it invisible to site owners. And here is the wildest part. It resolved its C2 domain through an Ethereum smart contract, querying public blockchain RPC endpoints. Traditional domain takedowns would not work because the attacker could update the smart contract to point to a new domain at any time.”

The full list of compromised plugins can be found on this link. If you are using any of these, it would be wise to replace them with a safer alternative. Ginder also shared a patching method on his blog.

In the meantime, WordPress removed all of the malicious plugins from the repository.

Via TechCrunch

• Smart Slider 3 plugin update compromised with backdoors
• Malicious version 3.5.1.35 pushed to 800,000+ sites
• Nextendweb urges rollback or upgrade to clean release

If you are using the Smart Slider 3 plugin for either WordPress or Joomla, make sure to update immediately, as experts have warned the tool was recently abused to distribute malware.

Nextendweb, the maintainers of Smart Slider 3, recently published a new security advisory, saying that on around April 7, 2026, unidentified threat actors broke into the system used for distributing patches, tainting the Pro version of the plugin with “multiple backdoors and persistence layers”, before pushing the poisoned version as an update to more than 800,000 websites.

An unknown number of websites likely installed the compromised version 3.5.1.35, before the developers spotted the attack and released a clean version - 3.5.1.36. Users are now urged to upgrade to this, or roll back to version 3.5.1.34.

Rolling back the updates

“If you have an available backup point, we strongly recommend rolling back your server to a backup created before version 3.5.1.35,” the advisory reads.

“The compromised update was released by the attacker on April 7, 2026. Due to time zone differences, it is safest to restore from a backup dated April 5, 2026 or earlier.”

Nextendweb says the malicious plugin version includes multiple backdoors which allow threat actors to execute system commands remotely (via HTTP headers) or execute arbitrary PHP code via hidden request parameters. The backdoors also create a hidden admin user and hide it from the admin interface. Persistent backdoors were found in these locations:

wp-content/mu-plugins/object-cache-helper.php

theme functions.php

wp-includes/class-wp-locale-helper.php

Finally, the backdoor can send site and credential data to an external server which is why, Nextendweb says, affected sites “should be considered fully compromised.”

Besides rolling back the update, there is a number of steps website admins should use to make sure their assets are cleaned, which can be found on this link.

Via BleepingComputer

Cloudflare’s recent launch of EmDash marks one of the most ambitious attempts in years to rethink the foundations of content management on the web.

WordPress has dominated the space for nearly a quarter of a century, powering over 40% of all websites and allowing millions of people and businesses to publish content online. Its success helped democratize publishing, but its architecture — first introduced 24 years ago — was designed for a very different era of the internet.

Today’s web is shaped by serverless infrastructure, distributed computing, and increasingly by AI-driven workflows, and many of WordPress’s core assumptions no longer reflect that reality.

One of the most persistent challenges facing WordPress is security, particularly around plugins. While they have always been central to WordPress’s flexibility, they are also its greatest vulnerability.

A fully open source, serverless CMS

Industry data shows the overwhelming majority of WordPress security issues originate from plugins, largely because they run with broad access to a site’s core systems.

This creates a model where flexibility comes at the cost of trust, forcing administrators to rely heavily on reputation, manual reviews, and marketplace controls to decrease risk.

This is where EmDash comes in. Intended as a modern alternative, it has been built specifically to address these long-standing structural issues.

Designed as a fully open source, serverless CMS written in TypeScript, it introduces a fundamentally different plugin architecture in which extensions operate within isolated sandboxes and can only perform actions they explicitly request.

EmDash, which you can play around with here, also reflects changes in how today's websites are built and managed, including native integration with AI tools, automated workflows, and new payment mechanisms for machine-to-machine access.

Rather than attempting to replace WordPress outright, EmDash represents an effort to evolve the publishing model. I spoke to Matt Taylor, Senior Product Manager at Cloudflare to find out more.

• Let's start with the most obvious question. Why did Cloudflare decide to launch a "spiritual" successor to WordPress?

We built EmDash to modernize what WordPress started, for today’s web. WordPress was created over two decades ago for a very different Internet. Since then, hosting has shifted toward serverless infrastructure, where applications can scale to zero, and many capabilities that once required plugins — like storage, authentication, and payments — are now built directly into the platform.

As a result, the plugin model has become both less necessary and an increasing security risk, while AI is reshaping how software is built and how content is created.

EmDash is designed to address these shifts directly: a more secure, scalable platform that runs on modern infrastructure and supports AI-native workflows.

• Why choose to do it now, rather than before?

Because the economics of publishing are now under real pressure in ways they weren’t before. The Internet is entering an AI-driven phase where agents are consuming content at scale, often without attribution, visibility, or compensation for the creators. That puts publishers and content owners at risk of losing control over the very assets their businesses depend on.

Luckily, technology has reached a point where a different model is possible. With AI, serverless infrastructure, and new approaches to payments and access, there’s now an opportunity to rebuild how publishing works — so content can be discovered, protected, and monetized in a way that’s sustainable in an AI-driven Internet.

• You already have Payload on Workers as a CMS product. What will happen to that project?

Payload is a CMS designed to be run ‘headless’, which means you bring your own frontend and link it up to Payload. EmDash, by comparison, is more like WordPress, in being full-stack and containing both a frontend and administration interface.

The Payload template is operated by the Payload team, who are now at Figma, and we expect no change to their support for that template.

• Auttomatic has been very, very proactive when it comes to defending its brand. I assume that Cloudflare had a word with Matt Mullenweg before adopting the "spiritual successor to WordPress" tagline rather than say, alternative to WP.

As Matt noted in his blog post, we met with him beforehand to give him a demo on what we were going to release to hear his thoughts. WordPress has done some incredible things for the Internet over its life, as we have said, but it is architecturally stymied, and is simply not the default choice of new developers.

We wanted to build something for this generation, which is spiritually to them what WordPress was to us when we were young developers.

• What's the support plan for EmDash and how are you planning to develop the Em-Dash community?

Dynamic Workers are in public beta and have no free tier at the moment, but are included on the $5 Workers plan.

Cloudflare has a history of launching new products to paid customers first, before making them available via our generous free tier. For example, we just launched a free queues tier: https://developers.cloudflare.com/changelog/post/2026-02-04-queues-free-plan/

• You mentioned that your AI coding agents have built this entire platform in 60 days. Can you tell us more?

Agents are becoming more capable every day. Matt Kane orchestrated thousands of agentic sessions, each planning, coding, testing and verifying against one another. As with the work we did on Vitest, the experience required to understand good practice — and the quality of your specifications — are now some of the most important skills in software engineering.

A lot of what made up EmDash pre-release were dozens of files of extremely detailed instructions on what the system should do, how it should perform it, and how it would know when it didn’t hit the mark. This context is critical for agents.

• WordPress is an open source project. EmDash is an open source project. Why didn't you contribute or get your own WP fork like others before?

EmDash was rebuilt from the ground up without using any WordPress code. That allowed us to address long-standing issues — particularly around plugin security and legacy architecture — and design for serverless environments from the start. It also enabled us to adopt a permissive license and create a system that is not constrained by past design decisions.

• Why did Cloudflare choose the MIT license rather than GPL? Is it a deliberate move towards a more organized ecosystem?

We have noticed that the GPL license for WordPress, which is known as a ‘viral’ copyleft license, restricts the commercial opportunities around developing in its proximity, and we wanted to make EmDash more permissive.

Lawyers get very worried when you mention including GPL code at software companies, and we didn’t want EmDash to be on their radar.

• What is the current roadmap for EmDash? How far are we from an autonomous CMS managed entirely by AI agents?

Closer than you might think: there are already plugins for CMSs like WordPress that are entirely autonomously operated, with humans providing the most basic of approvals.

From our perspective we’re more interested in how an AI agent can assist you in managing your CMS and its content. Though folks are welcome to build on the APIs we have in EmDash to provide an entirely autonomous CMS if they wish!

• One of my colleagues highlighted the trend of infrastructure firms launching, buying or sponsoring OSS projects that run best or prioritize the vendor’s own stack. Is that sustainable? Is it in the spirit of OSS?

We want users to have a range of options for building on the web. Where we can support projects to broaden that range, we historically have to the benefit of the wider ecosystem.

As an example, vinext was created to address challenges with deploying Next.js outside of Vercel, but vinext was not built exclusively for Cloudflare and can improve the experience of Next.js users on other platforms like Netlify, AWS, and Google Cloud.

• Matt Mullenweg welcomes the competition, innovation and open-source nature of EmDash
• He sees it as an opportunity for Cloudflare to plug its own services
• Mullenweg says it's great, but it's not a 'spiritual successor'

Automattic and WordPress.com CEO Matt Mullenweg has weighed in on Cloudflare's launch of EmDash, rejecting the company's claim that the new project is WordPress's spiritual successor.

In a blog post, Mullenweg explains why EmDash isn't the website builder's spiritual successor, why EmDash hasn't solved the plug-in problem it criticized WordPress for, and how security issues can be fixed in the future.

"It’s all built on open source and web standards," he asserts. "You can run it anywhere; there’s no lock-in."

Mullenweg rejects EmDash claims

Mullenweg explained WordPress can run anywhere, from a Raspberry Pi or a smartphone to a cheap server or across multiple hyperscaler data centers – it's all the same code. On the flip side, he sees EmDash as an opportunity to sell Cloudflare services.

Mullenweg uses the post to praise Cloudflare, noting the company's status as a "top engineering organization" that's pro-open-source.

All in all, he doesn't have a bad word to say about EmDash or Cloudflare in principle, however for interoperability and avoiding vendor lock-in, he notes that EmDash only runs optimally on Cloudflare.

As for the plug-in issue, Mullenweg explained that their unrestricted power is a feature, not a flaw, but artificial intelligence could significantly improve their security within the next 18 months.

"I actually think the product is very solid, there’s some excellent engineering, migration tools, it’s very fast, and the Astro integration is nice," he concludes.

So while EmDash isn't the spiritual successor to WordPress in Mullenweg's eyes, he welcomes the competition and supports that it's open-source. However, if there is to be a spiritual successor, it would be "even more open."

• Cloudflare has launched its very own CMS – EmDash
• EmDash plugins are secure by design, WordPress has a queue of 800 to test
• WordPress users can easily migrate to the "AI native CMS" that is EmDash

Cloudflare has lifted the wraps off EmDash, a new open source CMS that it deems to be the "spiritual successor" to WordPress.

The company explained an overwhelming majority (96%) of WordPress vulnerabilities come from plugins, which have full access to the database and filesystem, and run in the same environment as the core code without any isolation.

To tackle this, Cloudflare is putting each EmDash plugin in an isolated sandbox, called Dynamic Workers, with plugins having to declare exactly which permission it needs upfront.

Cloudflare says EmDash is more secure than WordPress

In its announcement, Cloudflare criticized the fact that existing WordPress plugins must be trusted, and that their availability on centralized plugin marketplaces serves to give them a good reputation. WordPress.org currently manually reviews and approves every plugin for the platform, and there's a queue of around 800 plugins right now that need to be verified.

Instead of this trust, EmDash plugins must be secure by design. And because developers can ship plugins with any license running independently of EmDash that run in secure sandboxes, Cloudflare is able to do away with the marketplace lock-in it criticizes.

Better still, EmDash is built to the scale-to-zero principle, meaning that it only bills for CPU time when it's actually operating – "it scales back down to zero if there are no requests," the company wrote.

"We’ve bet on this architecture at Cloudflare in part because we believe in having low cost and free tiers, and that everyone should be able to build websites that scale," Senior Product Manager Matt Taylor and Senior Principal Systems Engineer Matt Kane added.

For the front end, EmDash is powered by Astro which allows users to build themes of pages, layouts, components, styles and and more.

Finally, Cloudflare describes EmDash as an "AI native CMS" that includes Agent Skills, CLI and a built-in MCP server.

Users wishing to migrate from WordPress can either import their WXR file or do so by, funnily enough, installing a plugin (EmDash Exporter).

• Smart Slider 3 WordPress plugin (used on 800,000 sites) carried Arbitrary File Read flaw enabling access to sensitive server files
• Vulnerability allowed even low-privileged accounts to exfiltrate credentials and configuration data via AJAX export functions
• Patch released in version 3.5.1.34, but nearly 500K sites remain exposed; users urged to update immediately

A popular WordPress plugin used by hundreds of thousands of websites reportedly carried a vulnerability which allowed threat actors to steal sensitive information such as login credentials, experts have warned.

Smart Slider 3, which is currently active on more than 800,000 websites, allows users to create responsive, customizable sliders and visual content blocks without needing to code.

However Versions 3.5.1.33 and older were all vulnerable to an Arbitrary File Read flaw, which allows authenticated threat actors to access and read files on the server.

Patching and securing websites

The vulnerability in Smart Slider 3 stems from missing permission checks in its AJAX export functions. Although a security token (nonce) exists, authenticated users can obtain it, allowing even low-privileged accounts (like subscribers) to trigger the export process.

The actionExportAll() function ultimately packages files into a downloadable .ZIP file using file_get_contents() without validating file type or source, and as a result, the attackers can include even arbitrary server files, such as sensitive configuration files (for example, wp-config.php). This lack of restrictions enables authenticated attackers to read confidential data stored on the server.

Since some of the files contain sensitive information, such as credentials, keys, or salt data, the vulnerability can be rather disruptive. But because the threat actors need to be authenticated to be able to pull off the attack, the vulnerability was given a medium severity score. However, some are saying that memberships and subscription options are “common” on many platforms these days, suggesting that the risk is greater than what the vulnerability’s severity score shows.

The bug was first spotted by security researcher Dmitrii Ignatyev in late February 2026, and reported to Wordfence in early March. He received a $2,200 bounty for his findings.

Nextendweb, the maintainers of Smart Slider 3, have released a patch with version 3.5.1.34, and at the time of writing, the latest version was downloaded exactly 308,575 times - meaning just under 500,000 websites are still vulnerable.

Currently, there are no reports of the bug being exploited in the wild, but users are advised to update their plugin as soon as possible to avoid being targeted.

Protecting WordPress websites

As a platform, WordPress is generally considered safe and without known major vulnerabilities. However, it operates a vast repository of third-party, user-built themes and plugins, split into free and premium categories. The latter ones usually come with a dedicated maintenance and development team and as such are regularly updated and hardened against attacks.

The free ones, on the other hand, are often built by enthusiasts, small teams, and freelance developers. Many of them are abandoned, unmaintained, or otherwise poorly managed, despite being popular among the users. As such, they create a huge security risk on one end, and attack opportunity on the other.

As a general rule of thumb, security researchers advise WordPress users to keep their platform, themes, and plugins updated at all times. Furthermore, they suggest users only keep installed those themes and plugins they actively use and make sure to replace any default security and privacy settings.

Via BleepingComputer

• Ongoing cyberattack compromises BuddyBoss update system
• Malicious updates steal admin credentials, Stripe keys, and databases
• Hundreds of sites already hit; thousands more at risk, admins urged to disable auto-updates and rotate credentials

A major cyberattack against websites running the BuddyBoss WordPress plugin is currently ongoing, and users are urged to secure their assets or risk complete compromise and website takeover.

BuddyBoss is a WordPress platform and theme people can use to create online communities, membership sites, and e-learning platforms. It apparently has 50,000 customers, including 27,000 BuddyBoss Platform and BuddyBoss Theme package users.

According to Cybernews, an unidentified French-speaking threat actor somehow broke into the system that delivers software updates for BuddyBoss. There, they used Claude to help write malicious code and figure out how to push it to the update server.

Hundreds of compromised sites

Popular AI tools such as Claude have strict guardrails that prevent this kind of abuse, but the attackers managed to trick it (likely by pretending it’s a harmless hacking challenge).

After managing to insert malware into the updates, they simply waited for users to install them, compromising their websites in the process. This attack was first spotted on March 19, it was said. The malware was designed to steal admin passwords and API keys, copy entire databases, and open a backdoor to grant remote control access.

According to Cybernews, some of the data already stolen in the campaign includes Stripe payment keys, making this campaign particularly worrisome.

Compromised versions are BuddyBoss Platform 2.20.3, and BuddyBoss Theme 2.19.2. All website admins using any of these are urged to temporarily disable automatic updates, revert to server backups made before updating to these versions, and then analyze their server logs for potential indicators of compromise. Finally, all passwords, API tokens, and other credentials, should be rotated as soon as possible.

Cybernews says “hundreds of websites” have already been compromised, with “thousands” more remaining in danger. At press time, at least 309 websites have had their credentials and databases exfiltrated.

Via Cybernews

• Ally WordPress plugin carried SQL injection flaw (CVE-2026-2413)
• Vulnerability left ~246,600 sites exposed to data theft
• Fixed in version 4.1.0; WordPress urges immediate updates

A popular WordPress plugin with hundreds of thousands of active installations carried a high-severity vulnerability that allowed malicious actors to steal sensitive data from websites, experts have warned.

Ally is a web accessibility tool from Elementor, released in November 2025 as a tool that not just identifies accessibility issues but also offers solutions and walks web admins through the process of applying them.

But according to security researcher Drew Webber from Acquia, Ally was carrying an SQL injection vulnerability that allows unauthenticated attackers to submit data to the SQL database without proper sanitation.

Thousands of vulnerable websites

“This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database via time-based blind SQL injection techniques,” Webber noted.

The bug is tracked as CVE-2026-2413, and was given a severity score of 7.5/10 (high). It affects all versions up to 4.0.3, and was fixed on February 23, through the version 4.1.0.

Looking at the WordPress.org website, there are more than 400,000 active installations right now, with 38.4% (153,600) running the latest version. That leaves roughly 246,600 vulnerable websites.

WordPress is generally considered a safe website builder platform, with the majority of vulnerabilities coming from third-party plugins and themes. That is why most security professionals advise users only keep those plugins and themes that they’re using and make sure they’re updated at all times.

Besides upgrading Ally, users should also upgrade the platform itself, since it recently released the latest security update, with WordPress 6.9.2 fixing 10 vulnerabilities, including a cross-site request (XSS) flaw, an authorization bypass vulnerability, and a server-side forgery request (SSRF) bug.

WordPress urges its customers to install the latest version “immediately.”

Via BleepingComputer

• WordPress Playground lets you build fully local, non-published websites
• Sites are limited to 100MB and are stored locally, per-device
• You can still use WordPress plugins

WordPress has announced the launch of my.WordPress.net – a new service that lets the website builder run entirely within a web browser, meaning you can create a totally private website-style interface without it ever appearing on the public internet.

It's build on WordPress Playground, a project that lets WordPress run locally, so users won't need to choose a hosting provider or register a domain.

Because these new types of site run locally within the browser storage, they'll be device-specific and cannot be accessible from your other devices.

WordPress lets you create a local website within your browser

However, is users end up so impressed by their own work that they want to make it public, they can shift it to a WordPress host if they want to publish it on the internet, because the site itself will have already been built using the familiar WordPress tools.

The local sites are primarily designed for personal workspaces, though, covering tasks like journalling, researching or prototyping.

They're also ideal for learning how to WordPress without committing to hosting expenses. "It offers a fast, commitment-free way to explore, learn, and build, whether the result is a long-term personal project or something that eventually moves elsewhere," WordPress wrote in an announcement.

WordPress even detailed how users can connect with extra plugins to use all of the same tools you'd usually get with WordPress, but on a local scale.

There are some limitations though, including local storage, which starts at around 100MB. First launch also takes longer while WordPress downloads into the browser, and because it's not stored with a hosting provider, it's recommended that users backup their sites regularly.

• Rapid7 uncovers large-scale WordPress hijacking campaign
• Fake Cloudflare CAPTCHA tricks visitors into running malware
• More than 250 sites compromised, including a US Senate candidate’s page

Cybercriminals are hijacking vulnerable WordPress websites left and right and turning them into launchpads for malware deployment, experts have warned.

Security researchers Rapid7 claim to have spotted an ongoing, automated, large-scale campaign that even affected an unnamed US Senate candidate.

As per the researchers, the crooks first scan the web for vulnerable WordPress websites. There can be a myriad of things, from default or poor admin login credentials to unpatched themes and WordPress plugins with widely available exploit solutions, that are being used to gain initial access.

Deploying an infostealer

The campaign likely started in December 2025 and has so far affected more than 250 websites around the world.

Once inside, the crooks would do their best not to raise any alarms. Nothing on the site actually gets changed - the only thing they do is add a fake Cloudflare CAPTCHA at first visit. This is such a common, usual practice these days that most people don’t think twice about it, they just complete the puzzle, confirm they’re not a robot, and go about their day.

But the manner in which users are asked to solve the CAPTCHA should be a huge red flag. Instead of clicking a box or sliding a slider, they are asked to copy and paste a command into Windows Run, in classic ClickFix fashion.

So, instead of proving they’re human, the visitors end up downloading and running malware themselves. In this case, an infostealer designed to exfiltrate login credentials, authentication cookies, cryptocurrency wallet information, and other sensitive data.

Rapid7 says the campaign is likely highly automated and doesn’t target any specific industry. Regional media outlets, small business websites, and even a US Senate candidate’s official webpage, were among the confirmed cases.

"The large-scale execution of the compromise across completely unrelated WordPress instances suggests a high level of automation by the threat actor and is likely part of an organized long-term criminal effort," Rapid7 said in its report.

Via The Register

• Critical flaw found in WordPress plugin allowing attackers to register admin accounts unauthenticated
• Over 37,000 sites currently exposed

Tens of thousands of WordPress websites are vulnerable to full site takeover, thanks to a critical-severity vulnerability just discovered in a popular plugin.

Security researchers at Defiant reported finding a bug in User Registration & Membership, a WordPress plugin which helps admins create subscription plans, control user access, and accept payments. The bug is due to the plugin accepting user-supplied roles during membership registration, without properly enforcing a server-side allowlist.

As a result, unauthenticated attackers can create admin accounts by supplying a role value at registration.

Actively abused

The bug is described as “improper privilege management” and is now tracked as CVE- 2026-1492. It has a severity score of 9.8/10 (critical) and affects all versions of the plugin up to, and including, 5.1.2. It was fixed in version 5.1.3 which is now available for download.

The researchers said they saw more than 200 attempts to exploit this vulnerability in just 24 hours, suggesting that cybercriminals are well aware of the flaw and are actively looking for exposed websites.

The attack surface is rather large, too, as according to the official WordPress repository, User Registration & Membership is installed on more than 60,000 active websites, and the vast majority (62.7%) are running versions 4.4 and older.

That means at least 37,000 websites are currently susceptible to the improper privilege management bug.

To make matters worse, the plugin page does not differentiate between versions 5.1.2 and 5.1.3, so it is quite possible that the actual number of vulnerable websites is even greater.

With an admin account, threat actors can wreak all sorts of havoc, from exfiltrating sensitive data, to using the website as a host for malware. They can also redirect legitimate traffic to malicious websites ridden with ads, can trick users into sharing login credentials, and more.

Via BleepingComputer

• WordPress.com now uses AI to make site layout changes with natural language prompts
• Nano Banana image generation and editing is integrated with the media library
• It's available to use now, but you need to turn it on in settings

Set against a background of other AI-powered website builders, WordPress.com has launched its own AI Assistant, and it covers more than just generating copy.

The company explains its new assistant will be able to understand a site's content and layout, therefore users can make more complex changes with simple natural language prompts.

"No copy-pasting, no prompt engineering, and no code to figure out what to do with," Head of AI Ronnie Burt wrote in a blog post.

WordPress.com launches its own AI Assistant

WordPress.com highlighted three key areas where its AI Assistant can help: creating and editing content with context, generating and tweaking images, and colleague-style collaboration. Some of the changes handled include adjusting layouts, styles, colors, fonts and page structure, as well as other copy-related tasks like generating and translating text.

On the page editor front, WordPress.com shows examples of the AI Assistant making changes based on pretty loose, unspecific commands, such as 'Make this section feel more modern and spacious'.

Besides generating text, AI Assistant can also generate and edit images using Google's Nano Banana models directly within the media library without having to use third-party platforms.

Burt also pointed to the new block notes editor that launched with WordPress 6.9, which provides colleagues with a space to collaborate and share comments. Unsurprisingly, the AI Assistant also plays a role here, where it can do things like fact-check or make edit suggestions.

WordPress AI Assistant is now generally available, but users must opt in via Sites > Settings > AI tools. Sites already built using the AI website builder option will have AI Assistant enabled by default.

• WPvivid Backup & Migration plugin vulnerable to critical RCE flaw CVE-2026-1357
• Exploitation requires “receive backup from another site” option enabled, with 24-hour attack window
• Patch released in version 0.9.123 (Jan 28); users urged to upgrade immediately

WPvivid Backup & Migration, a WordPress plugin with almost a million installs, is vulnerable to a critical-severity flaw that allows threat actors to run malicious code remotely.

Although it sounds ominous, the bug has a few limitations that make exploitation somewhat difficult.

The affected WordPress plugin lets users create site backups, restore them, and migrate sites to new domains or hosts. The core features are available for free, with optional premium upgrades for more advanced functions. It currently counts more than 900,000 active installations and more than 20,000 customers.

Exploiting and patching

However security researchers Defiant found the plugin suffers from improper error handling in the RSA decryption process, combined with a lack of path sanitization. As a result, threat actors could upload arbitrary files to the server without authentication, achieving remote code execution (RCE).

The bug is tracked as CVE-2026-1357 and has a severity score of 9.8/10 (critical). It affects all versions up to 0.9.123, which was released on January 28.

While all users are advised to upgrade to a safe version as soon as possible, exploiting this vulnerability is not as easy as it sounds. Only sites that have “receive backup from another site” option enabled are vulnerable, and this feature is not turned on by default.

What’s more, the miscreants only have 24 hours to attack, given that the key the other sites need to send backup files expires after a day.

Unfortunately, there is no way to tell exactly how many, of the 900,000 active installations, are vulnerable. The official WordPress plugin website only shows installations of version 0.9, without further segmentation. It does state that since January 28, the day of the patch, up until today, the plugin was downloaded roughly 200,000 times.

Via BleepingComputer

• WP Engine says Automattic went after 10 other companies for royalties
• Stripe was approached to end its WP Engine contract, the hosting platform alleges
• Automattic says this is just an attempt to revive old complaints that have been dismissed

WP Engine has filed a third update to its complaint against Automattic and CEO Matt Mullenweg, focusing on the WordPress trademark and whether WP Engine contributes enough to the open source platform.

Mullenweg had previously demanded 8% of WP Engine's monthly gross revenue as a royalty to use the WordPress brand on the basis that it wasn't giving enough to the open source platform, but WP Engine sued with allegations of abuse of power.

The latest update claims Mullenweg had also planned to target 10 other hosting companies with similar royalty demands.

WP Engine updates its complaint against Automattic

"WP Engine’s Third Amended Complaint contains newly unredacted information uncovered during discovery which had been previously sealed at the request of the Defendants," the hosting company wrote in a blog update.

The complaint says that Newfold Digital is already paying Automattic for trademark use – names of the other companies were redacted.

WP Engine even alleges that Mullenweg had tried to pressure Stripe into cancelling WP Engine's payment processing contract after the lawsuit was filed.

In response, Automattic says the renewed filing is just an attempt to repackage old allegations, and that it's confident the courts will reject them. "There is nothing new here. This is the same narrative WP Engine has been pushing for over a year, and the Court has already dismissed many of its central claims," an Automattic spokesperson added.

In November 2025, WP Engine filed to dismiss counterclaims issued by Automattic, Matt Mullenweg, the WordPress Foundation and WooCommerce.

Previous updates include "new facts uncovered during discovery" in a second amendment and antitrust claims in a first amendment.

"The Court’s Motion to Dismiss ruling permits the majority of WP Engine’s claims, including the intentional interference, unfair competition, and defamation claims, to proceed," WP Engine added.

• An SQL injection flaw in QSM plugin versions 10.3.1 and below was found
• Vulnerability allows logged-in users (Subscriber or higher) to extract sensitive database data
• WordPress admins urged to update QSM to v10.3.2 or newer to mitigate risk

If your website is running the Quiz and Survey Master WordPress plugin, you might want to update it to the latest version, or risk a possible cyberattack.

QSM lets users create quizzes, surveys, and forms without coding, with more than 40,000 websites actively using it - but recently, it was discovered versions 10.3.1 and older were vulnerable to an SQL injection flaw which allowed any logged-in user to inject commands into the database.

A security advisory from Patchstack noted this means any user with a “subscriber” account, or one with higher privileges, could perform a wide array of unwanted actions on vulnerable websites, including data exfiltration.

How many websites are vulnerable?

Users are advised to update to this, or any newer version, as soon as possible. As per data on the official WordPress.org website, the newest version is 10.3.5.

Unfortunately, there is no way of telling exactly how many websites are patched, and how many remain vulnerable. Official numbers are showing that a slim majority - 52.1% - are running version 10.3, which means that at least 47.9% - which equals 19,160 websites - are definitely vulnerable. Of the remaining 39,980, at least some are running the vulnerable version 10.3.1.

Right now, there is no evidence of the flaw being abused in the wild, but given its popularity, it is safe to assume that threat actors will now start scanning for websites using QSM. The bug is now tracked as CVE-2025-67987 and was fixed in version 10.3.2.

As a general rule of thumb, WordPress users should always keep their website builder platforms updated, as well as any plugins and themes they are using. Security professionals also advise that all plugins and themes that are not actively being used be deleted from the servers entirely.

Via Infosecurity Magazine

• Critical bug in ACF: Extended WordPress plugin allows arbitrary role escalation to administrator
• About 50,000 WordPress sites are vulnerable despite patch in version 0.9.2.2
• No exploitation reported yet, but attackers likely to probe exposed sites soon

Around 50,000 WordPress websites are currently at risk of full site takeover, due to a critical-severity vulnerability that was recently discovered in a popular plugin.

In mid-December 2025, Wordfence was notified by security researcher Andrea Bocchetti of a vulnerability in Advanced Custom Fields: Extended, a plugin which adds more features to the Advanced Custom Fields (ACF) plugin.

ACF also lets users add custom fields to posts and pages, and it is currently being actively used by around 100,000 WordPress websites.

How to stay safe

Bocchetti said that the bug stems from role restrictions not being enforced properly during form-based user creation, or updates.

"In the vulnerable version, there are no restrictions for form fields, so the user's role can be set arbitrarily, even to 'administrator', regardless of the field settings, if there is a role field added to the form," Wordfence explained in its advisory.

"As with any privilege escalation vulnerability, this can be used for complete site compromise.”

In other words, any unauthenticated user can set themselves as admins for a WordPress site, essentially taking over the site.

The vulnerability was discovered in versions 0.9.2.1 and earlier and is now being tracked as CVE-2025-14533. It was given a severity score of 9.8/10 (critical).

The silver lining is that it cannot be exploited easily. The sites need to use a ‘Create User’ or ‘Update User’ form with a role field mapped.

The bug was remedied in version 0.9.2.2. According to WordPress’ official stats, approximately 50,000 websites have already updated to the newest version, leaving roughly the same number of those that are still vulnerable.

At press time, there was no evidence of the flaw being abused in the wild, but now that the news is out there, it is safe to assume that cybercriminals will start at least probing for vulnerabilities.

Via BleepingComputer

• Patchstack found critical Modular DS flaw (CVE-2026-23550) allowing admin bypass
• Vulnerability scored 10/10 and is already being exploited in the wild
• Vendor released fix in version 2.5.2; users urged to upgrade immediately

If your WordPress website is running the Modular DS plugin, you might want to update to the latest version as soon as possible.

Modular DS is a popular WordPress plugin used by more than 40,000 websites which allows website admins manage multiple WordPress sites from a single dashboard.

However security researchers Patchstack recently discovered its versions 2.5.1 and older carried design and implementation vulnerabilities which exposed multiple sensitive routes and activated an automatic login fallback mechanism.

Evidence of attacks

These vulnerabilities include direct route selection, bypassing of authentication mechanisms, and auto-login as admin, the researchers explained. As a result, malicious actors could have bypassed all authentication mechanisms remotely and access the compromised websites with an administrator account.

“As soon as the site has already been connected to Modular (tokens present/renewable), anyone can pass the auth middleware: there is no cryptographic link between the incoming request and Modular itself,” Patchstacak explained.

“This exposes several routes [...] which allow various actions to be performed, ranging from remote login to obtaining sensitive system or user data.”

The vulnerability is now tracked as CVE-2026-23550 and was given a severity score of 10/10 (critical).

In its write-up, Patchstack said the flaw is already being exploited in the wild, and that first attacks were detected on January 13, 2026, citing WP.one Support Engineer’s team. The Modular DS vendor was notified on January 14 (a day after the first attacks were confirmed), and it came back with a fix “only a few hours later.”

The fix brought Modular DS to version 2.5.2, and users are now advised to upgrade without delay.

“We strongly recommend that all Modular DS installations ensure they are running this version as soon as possible and complete the following actions,” Modular DS said in a security advisory.

The actions advised include reviewing potential indicators of compromise (which can be found here), regenerating WordPress salts, regenerating OAuth credentials, and scanning the site for malicious plugins or files.

Via BleepingComputer

2026 is here, and with it - new business ideas, which all need a home online.

You've got two main options: hosting a website yourself with one of the best web hosting providers or using one of the best website builders around today.

The best website builders are platforms that help you build a website and include a bunch of business tools to help you manage your business. The best web hosting providers give you server space and the freedom to install the tools that you want to make your website and manage your business.

Website builders give you everything you need pre-configured and integrated but they're more expensive and less flexible. Web hosting is cheaper and gives you more choice - but what is the use of choice if you don't understand the options? In this article I'll unpack them to make it simple and easy to host your own site.

Web hosting providers

The first choice is which web hosting provider to use - and for this article, I've narrowed this down to three providers. Hostinger, Bluehost, and Namecheap.

Hostinger has one of the most complete web hosting packages that makes it comparable to a website builder and they have their own website builder too. It has very low starter prices but renewal prices are high compared to other hosting options.

Bluehost has, in my opinion, one of the best WordPress page builders on the market making created WordPress sites super easy. The hosting packages are less complete, starter prices are also low but renewal and add-ons do increase the price later on.

Namecheap, as the name would suggest, is cheap and has everything you need but the user experience is not as friendly as the above options.

After going over the pros and cons of these three providers I'll throw in a website builder comparison.

Hostinger

What you get

On the most basic Premium plan ($1.99/mo for 48 months, then $12.99/mo), Hostinger should give you everything you need for a weekend launch.

Other plans give you more features, support more website, and provide more performance, but the Premium plan should be fine, as it includes:

A free domain for one year - When you use the domain from Hostinger you don't need to configure or do anything other than find a domain name that's available. When it comes to the subsequent years, using the domain from Hostinger is slightly more costly than using one of the best domain registrars to manage your domain name but you will need to configure it yourself (easy if you want to).

20 GB of storage - This should be plenty of storage for most websites.

2 mail boxes per website - Be aware that these are only free for one year.

Website building options - You can use an AI website builder for WordPress - just WordPress, or Hostinger's Website Builder. I'd recommend the AI website builder for WordPress, or just WordPress because you have more flexibility.

All of these options can be installed easily with one click and don't require any additional configurations.

You can check out a step by step process on how to create a site with Hostinger in my 60 Minutes with Hostinger article.

Bluehost

What you get

On Bluehost's Starter plan ($3.99/mo for 36 months, then $9.99/mo), you also get everything you should need for a straightforward launch.

A free domain for one year - As with Hostinger, it is easy enough to use this free domain for a year - but you might want to check out other options at a later date.

10GB of storage - Less than Hostinger, but still plenty of storage for most websites.

Pro Email - Only free for a year, and then an additional $2.99/mo after.

Website building options - Bluehost just provides an AI builder for WordPress, and I think it's better than Hostinger's AI WordPress site building tool.

WonderBlocks makes it really easy to edit and modify WordPress sites - and you can read my 60 Minutes with Bluehost article to see how easy it is to build and manage a website with this option.

Namecheap

What you get

Once again, you can find everything you need to start and manage a website with Namecheap's basic plan: Stellar ($1.98/mo for 12 months, then $4.88/mo).

A free domain for one year - Namecheap has some of the lowest renewal prices for domains, so you won't need to search elsewhere after your year's free trial is up.

20GB SSD storage - Par for the course, and should be all you need.

30 Mailboxes- This is the real bonus, as our previous hosts require you to pay extra for email after one month or a year - but with Namecheap, email is included, and free forever.

Website building options - You have a few options with Namecheap and it can be a bit overwhelming, so I'm just going to mention two: WordPress and the AI Website Builder.

The AI Website Builder is OK but it doesn't support ecommerce and doesn't have the same maturity and amount of options as WordPress. I'd stick with WordPress but you get less of a helping hand using the WordPress page builder.

Website Builder option: Wix

What you get

Wix's cheapest plan is $17/mo from the starting block, and you don't get much for it.

A free domain for one year - The first year is free and the 'starting' price is stated but the renewal cost is hidden.

2GB storage - This isn't much compared to some other options, but should be manageable for most users.

Email - What email? None is provided.

Website building options - The upside to Wix is that it has a very user friendly page builder, but you don't get free add-ons like you do with WordPress - and if you wanted to leave Wix, you'll need to re-build your page from scratch.

Web hosting summary

Our tests show that there isn't much between the hosts when it comes to performance so the choice is entirely down to budget and how much of a helping hand you want with WordPress.

If I was on a budget and had more time to play with WordPress then I'd pick Namecheap.

If I could stretch my budget and needed help page building with WordPress I'd use Bluehost.

If I could extend my budget and in return get AI website management tools like Kodee and more features like email marketing, I'd go with Hostinger.

FAQs

• WordFence disclosed critical RCE flaw (CVE-2025-6389) in Sneeit Framework plugin, affecting versions ≤8.3
• Exploitation allows attackers to create admin accounts, install malicious plugins, and hijack WordPress sites
• Users urged to update to v8.4, monitor for rogue admins, suspicious PHP files, and malicious AJAX activity

Security researchers from WordFence have warned about a critical-severity vulnerability in a popular plugin which allows threat actors to add themselves as admins on WordPress sites.

In a security advisory published last week, WordFence said it found a remote code execution (RCE) bug in Sneeit Framework, a backend toolkit WordPress admins use to manage theme options, layouts, and custom features. The bug is tracked as CVE-2025-6389, was given a severity score 9.8/10 (critical) and affects all versions of the plugin prior to, and including, 8.3.

Version 8.4, released in early August 2025, is not affected. According to The Hacker News, the plugin currently has more than 1,700 active installations.

How to stay safe

Explaining how the vulnerability works, WordFence said that malicious actors could call an arbitrary PHP function and have it create a new admin user, which the attackers can then use to take full control over the target website. After that, they can easily install malicious plugins, add data scrapers, redirect victims to other sites, introduce phishing landing pages, and more.

Criminals reportedly started exploiting the flaw the moment it was publicly announced. The very first day, WordFence blocked more than 131,000 attacks, and even today, the number of daily attacks hovers at around 15,000.

The best way to remain safe from this vulnerability is to update the plugin to version 8.4. Users are also advised to keep their WordPress platform, as well as all other plugins and themes, updated at all times. Furthermore, all elements that are not in use should be deleted from the platform.

There are also indicators of compromise that webmasters should look out for - such as the appearance of a new, unauthorized WordPress admin account, created through the vulnerable AJAX callback.

Another red flag is the presence of malicious PHP files uploaded to the server, including webshells named xL.php, Canonical.php, .a.php, simple.php, or up_sf.php, as well as suspicious .htaccess files designed to allow execution of dangerous file types.

Compromised sites may also contain files like finderdata.txt or goodfinderdata.txt, generated by the attacker’s shell-finder tool. Log files showing successful AJAX requests from known attacking IPs — such as 185.125.50.59, 182.8.226.51, 89.187.175.80, and others listed in the report are another strong indicator that the vulnerability was used to access the site.

Via The Hacker News

• W3 Total Cache plugin flaw CVE-2025-9501 enables unauthenticated PHP command injection
• Affects all versions before 2.8.13; ~327,000+ sites remain at risk
• WPScan PoC exploit set for Nov 24, raising mass exploitation concerns

W3 Total Cache (W3TC), a WordPress plugin with more than a million users, carries a critical-severity vulnerability that allows threat actors to fully take over compromised websites, experts have warned.

The bug is described as a command injection flaw that works by submitting a comment with a malicious payload to a post. The attacker does not need to be authenticated on the website in order to inject PHP commands this way.

The vulnerability is now tracked as CVE-2025-9501, and with a severity score of 9.0/10 (critical), it affects all versions of the plugin before 2.8.13.

November 24 deadline

To patch the flaw, users should update their plugin to version 2.8.13, which was released on October 20.

Looking at the data from the Wordpress.org site, it says that 67.3% of pages have updated to version 2.8, while the remaining 32.7% are on older versions. That would put at least 327,000 websites at risk.

However, it doesn’t mean that all 67.3% are running version 2.8.13, so the actual number of vulnerable websites is likely a lot bigger.

In their security advisory, researchers from WPScan, a security scanner built specifically for the WordPress website builder, said they developed a Proof-of-Concept (PoC) exploit for the flaw, and set a deadline for November 24 to publish it. Before that, they expect the majority of websites to have updated their plugins to the secured version.

In many instances, mass exploitation starts the moment a PoC is released, since many threat actors can’t be bothered to develop one themselves, and will simply pick up on whatever is already out there. Therefore, it is crucial for WordPress site owners and admins to update before the deadline.

Via BleepingComputer

• Gootloader malware resurfaced in late October 2025 after a nine-month hiatus, used to stage ransomware attacks
• Delivered via malicious JavaScript hidden in custom web fonts, enabling stealthy remote access and reconnaissance
• Linked to Storm-0494 and Vice Society; attackers reached domain controllers in under an hour in some cases

After a nine-month sabbatical, the malware known as Gootloader is truly back, possibly being used as a stepping stone towards ransomware infections.

A report from cybersecurity researchers Huntress observed “multiple infections” from October 27 and into early November, 2025. Before that, the last time Gootloader was seen was in March, 2025.

In the new campaign, Gootloader was most likely leveraged by a group known as Storm-0494, as well as its downstream operator, Vanilla Tempest (also known as Vice Society), a ransomware group first observed in mid-2021, primarily targeting the education and healthcare sectors, with occasional excursions into manufacturing.

Hiding malware in custom fonts

Gootloader was used to deliver malicious JavaScript from compromised websites, the researchers explained. The script installs tools that give attackers remote access to corporate Windows machines, and enable follow-on actions, such as account takeover, or ransomware deployment.

Gootloader hid malicious filenames and download instructions inside a custom web font (WOFF2) so the page looked normal in a browser but showed meaningless text in the raw HTML. When a victim opened the compromised page, the browser used the font to swap invisible or scrambled characters for readable ones, revealing the real download link and filename only when rendered.

The purpose of the campaign is to gain reliable initial access, quickly map and control target networks, and then hand the access over to ransomware operators. The entire process is done as fast as possible, mostly through automated reconnaissance and remote-control tools that help identify high-value targets, create privileged accounts, and prepare for ransomware.

In some cases, Huntress added, the attackers reached domain controllers within hours. Initial automated reconnaissance often begins within 10-20 minutes after the malicious JavaScript runs, and in several incidents, operators achieved domain controller access in as little as 17 hours. In at least one environment they reached a domain controller in under one hour.

To defend against Gootloader, Huntress advises watching for early signs such as unexpected downloads from web browsers, unfamiliar shortcuts in startup locations, sudden PowerShell or script activity coming from the browser, and unusual outbound proxy-like connections.

Via The Hacker News

• King Addons plugin had two critical flaws enabling full WordPress site takeover
• Bugs allowed unauthenticated file uploads and privilege escalation via registration endpoint
• Users must update to version 51.1.37 to patch both vulnerabilities

King Addons for Elementor, a commercial WordPress plugin that extends the Elementor page builder with extra website builder widgets, templates, and design features, carried two critical-level vulnerabilities that allowed threat actors to fully take over vulnerable websites, experts have warned.

In a new security advisory, Patchstack detailed two bugs: an unauthenticated arbitrary file upload flaw (CVE-2025-6327), and a privilege escalation via registration endpoint flaw (CVE-2025-6325). The former has a severity score of 10/10 (critical), while the latter 9.8/10 (also critical).

Both bugs let a threat actor turn a vulnerable WordPress website into a beachhead. They can get code, or accounts, onto the site, and use them to execute actions that lead to full site compromise, or data theft.

Patching the bugs

Site admins using the “King Addons Login | Register Form” widgets should make sure to update the plugin to version 51.1.37 as soon as possible, since this patch fixes both vulnerabilities and mitigates potential site takeover risks.

“Both vulnerabilities are trivially exploitable under common configurations and require no authentication,” Patchstack warned. “Immediate patching is strongly recommended.”

Infosecurity Magazine says the vendor addressed the vulnerabilities across two versions, by introducing a role allowlist and input sanitization, as well as an upload handler that now requires proper permission and enforces strict file type validation.

King Addons for Elementor is a popular plugin with more than 10,000 active users. It provides more than 70 widgets, more than 650 templates, and more than 4,000 page sections, helping users build their websites without extensive coding knowledge.

Discovering critical vulnerabilities in WordPress add-ons and themes is nothing new.

Third-party extensions to the platform are the most common ways cybercriminals compromise and take over WordPress websites, which is why users are always advised to only keep the add-ons they use, and to make sure they are always updated to the latest versions.

• WordPress plugin flaw let low-privileged users access sensitive server files and credentials
• CVE-2025-11705 affects plugin versions 4.23.81 and earlier; patch released October 15
• About 50,000 sites remain vulnerable; admins urged to update immediately

A popular WordPress plugin with more than 100,000 active installations carried a bug that allowed threat actors to read any file on the server - including people’s emails and in some cases, passwords, too.

Security researchers at Wordfence reported a vulnerability in the Anti-Malware Security and Brute-Force Firewall plugin for WordPress. As the name suggests, this plugin allows site owners to scan for malware, protect their sites against brute-force attacks, defend against known flaws, and more.

However, the plugin was missing capability checks in one of its functions, which allowed low-privileged users to read arbitrary files on the server, including sensitive files such as wp-config.php that stores different credentials.

Patch available

In theory, malicious actors could this way obtain people’s email addresses, hashed or plaintext passwords (depending on what’s stored), and other private data.

The bug is now tracked as CVE-2025-11705 and has a severity score of 6.8/10 (medium) - a relatively low severity score, since attackers need to be authenticated in order to abuse it, but sites with any kind of membership or subscription, running the Anti-Malware Security and Brute-Force Firewall plugin, are considered vulnerable.

Versions 4.23.81 and earlier of the plugin are affected, it was said.

The researchers reported their findings to the vendor on October 14, and a patch was issued a day later, on October 15. Version 2.23.83 addresses the bug by adding a proper user capability check via a new function. Since the release of the patch, roughly half of the users (around 50,000) installed it, meaning there are still around 50,000 vulnerable websites.

At press time, there was no word of exploitation in the wild, but vulnerabilities like this one often get exploited months after the patch. Therefore, website admins are recommended to apply the fix as soon as possible.

Via BleepingComputer

• Unpatched GutenKit and Hunk Companion plugins exploited in mass WordPress attacks
• Attackers use ‘up’ plugin to gain admin access and deploy malware
• Wordfence blocked 8.7 million attempts in 48 hours; updates remain critical

Three critical-severity vulnerabilities, found in two WordPress plugins and fixed more than a year ago, are now being exploited in mass attacks against websites which still haven’t patched the issues.

WordPress security experts Wordfence said it blocked more than 8.7 million attack attempts over the course of roughly 48 hours utilizing GutenKit and Hunk Companion.

The former extends Gutenberg by adding dozens of extra blocks, templates, and layout tools, while the latter is a “helper” plugin for ThemeHunk themes that adds sections like “team”, “services”, “portfolio”, “sliders”, and more.

Malicious payload on GitHub

Between October and December 2024, three flaws were found - and patched - in the plugins: CVE-2024-9234, CVE-2024-9707, and CVE-2024-11972. All three were rated critical (9.8/10), and allow threat actors to install arbitrary plugins and run malicious code on vulnerable sites.

Now, threat actors are taking advantage of the fact that many sites are not that diligent when it comes to applying fixes.

Wordfence says the hackers are using the vulnerabilities to install a malicious plugin called ‘up’, that’s being hosted as a .ZIP archive on GitHub.

The plugin allows the threat actors to upload, download, or delete files from the site, as well as to tamper with the site’s permissions. It also allows the threat actor to automatically log into the vulnerable website as an administrator.

Wordfence also says that between other things, the attackers are using ‘up’ to set up persistence, steal information, and drop additional malware.

Being the one of the best website builder platforms, WordPress is a popular target among cybercriminals. However, since it is generally considered safe, the attackers usually go for themes and plugins, since these are often vulnerable, or lose support.

The best way to mitigate the risk is to only keep the plugins and themes you are actually using, and to make sure they are updated at all times.

Via BleepingComputer

• UNC5142 hacked 14,000+ WordPress sites to distribute malware
• Malware payloads were fetched from blockchain, boosting resilience and hindering takedowns
• ClickFix lures tricked users into running malicious commands

More than 14,000 WordPress websites were hacked and used as launchpads for malware distribution, Google’s Threat Intelligence Group (GTIG) said in a recent report.

Discussing the campaign in-depth, GTIG said that it is the work of UNC5142, a relatively new threat actor that emerged in late 2023 and stopped operations in late July 2025.

It is not yet known if the pause is temporary, permanent, or if the group simply pivoted to different techniques. Given their previous success compromising websites and deploying malware, Google believes that the group just improved their obfuscation techniques and still operates in the wild.

Blockchain and ClickFix

In the campaign, UNC5142 would “indiscriminately” target vulnerable WordPress sites - those with flawed plugins, theme files, and in some cases - the WordPress database itself.

These sites would be given a multi-stage JavaScript downloader dubbed CLEARSHOT, that enabled malware distribution. This downloader fetched the stage-two payload from the public blockchain, often using BNB chain.

The use of blockchain is interesting, the researchers found, as it improves resiliency and makes takedowns more difficult:

“The use of blockchain technology for large parts of UNC5142’s infrastructure and operation increases their resiliency in the face of detection and takedown efforts,” the report says.

“Network based protection mechanisms are more difficult to implement for Web3 traffic compared to traditional web traffic given the lack of use of traditional URLs. Seizure and takedown operations are also hindered given the immutability of the blockchain.”

From the public blockchain, the malware would pull a CLEARSHORT landing page from an external server. This landing page would serve the ClickFix social engineering tactic - prompting users to copy and paste a command into the Run program on Windows (or the Terminal app on a Mac) which ultimately downloads the malware.

The landing pages were typically hosted on a Cloudflare .dev page, it was said, and retrieved in an encrypted format.

Via The Hacker News

You might also like

• Devious new ClickFix malware variant targets macOS, Android, and iOS using browser-based redirections
• Take a look at our guide to the best authenticator app
• We've rounded up the best password managers

• CVE-2025-5947 allows unauthenticated admin access in Service Finder WordPress theme versions ≤ 6.0
• Over 13,800 exploit attempts observed since August; attackers actively target vulnerable sites
• Patching is critical; blocking five known IPs may help but won’t stop future attacks

Websites running the popular Service Finder Bookings WordPress theme are being actively targeted following the discovery of a critical severity vulnerability.

On July 17, Aonetheme released version 6.1 of Service Finder, which included a fix for an authentication bypass flaw that affected all versions up to, and including, 6.0. Since the plugin did not properly validate a user’s cookie value prior to logging them in, it was possible for unauthenticated attackers to log in as any user - including admin.

The vulnerability is tracked as CVE-2025-5947, and was given a severity score of 9.8/10 (critical), since it allowed full website takeover, data exfiltration, malware deployment, and more.

Thousands of attacks

The theme can be purchased on the Envato Market which shows it was acquired more than 6,000 times already. According to BleepingComputer, most sites that buy the theme are actively using it, so the attack surface could be rather large.

In addition, WordPress security company Wordfence says that since August 1, it observed more than 13,800 attempts to exploit this vulnerability, meaning threat actors are well aware of it and are actively hunting for victims. At press time, WordFence said it saw more than 200 attacks in the last 24 hours, alone.

Such a large number would suggest hundreds of attackers, but it seems that the majority of attack requests came from just five IP addresses.

This could make things easier for the defenders, since simply blocking them would be enough to prevent intrusions. However, the attackers could always switch to new ones, so patching the vulnerable product is still the best way to address the rising risk.

Also, those who are worried about being targeted should review their logs for suspicious or otherwise unexpected login activity, or accounts that threat actors may have created to establish persistence.

Via BleepingComputer

You might also like

• WordPress users beware - this popular plugin has been hijacked to push potential malware
• Take a look at our guide to the best authenticator app
• We've rounded up the best password managers

• An improper neutralization flaw was found in the WordPress Paid Membership Subscriptions plugin
• This plugin is used by more than 10,000 sites, enabling memberships and paying user accounts
• A patch is now available, so users should update immediately

A high-severity vulnerability has been discovered in a popular premium WordPress plugin, allowing threat actors to access, or exfiltrate, sensitive data without authentication.

Security researcher ChuongVN from the Patchstack Alliance recently found an “improper neutralization of special elements used in an SQL command” flaw, affecting the WordPress Paid Membership Subscriptions plugin.

Paid Member Subscriptions is a plugin helping site owners create and manage membership-based websites. It lets admins restrict content, create subscription plans, accept recurring payments, and control user access based on membership level. It is rather popular, being used by more than 10,000 websites.

Extracting emails or hashed passwords

Among the plugin's standout features is its integration with popular payment gateways like PayPal and Stripe, but this is also where the problem stems from.

The plugin’s handling of PayPal Instant Payment Notifications (IPN) was problematic, as when a transaction was processed, the plugin extracted a payment ID directly from user-supplied data and inserted it into a database query without proper validation.

By manipulating this input, attackers could gain unauthorized access to sensitive information or modify stored records.

In a real-life scenario, an attacker could inject malicious queries into the site’s database, allowing them to extract email addresses or hashed passwords of paying members. This information could then be used to launch phishing attacks against subscribers, or credential-stuffing attacks on other platforms where the same login details are used.

The bug is now tracked as CVE-2025-49870, and carries a severity score of 7.5/10 (high). It was fixed in version 2.15.2, and users are now advised to upgrade their plugins as soon as possible.

WordPress is the world’s best website builder platforms, powering more than half of all websites in existence. As such, its plugins and themes are a popular target among cybercriminals looking for an easy way into websites, their content, and their users’ data.

Via Infosecurity Magazine

You might also like

• Dangerous WordPress plugin puts over 160,000 sites at risk - here's what we know
• Take a look at our guide to the best authenticator app
• We've rounded up the best password managers

It's been a while since I used Bluehost, and the company has recently unveiled a host of new plans, as well as announcing a new CEO.

So, after Hostinger, DreamHost, and Kinsta I figured why not do Bluehost next in my One Hour With series.

I've only got 60 minutes, so lets crack on.

Start the clock 0:00

Signing up

Pretty easy and no surprises. I entered my payment details, and pretty much instantly I was directed to the panel with a message telling me WordPress was installing.

Before I had the chance to take screengrabs and read the messages from Bluehost in the pop-up box, WordPress had already been installed. I closed the box and was then asked how I wanted to build my WordPress site.

I was a little surprised to not see more options for templates here - but that's not a complaint, I quite like the simplicity.

The idea for this site was to offer a plant watering and rental service. I described the site, and then was presented with help options.

06:57

I picked intermediate, but as always I struggled with WordPress, and later regretted not selecting beginner.

I was then given three templates to choose from and picked the first.

Then, I started having the same WordPress page builder issues that I usually have.

It was easier for me this time because I have a little more experience with WordPress - but I still found it somewhat confusing and unintuitive trying to edit and change page elements.

I regretted selecting intermediate when I set up the site. I asked support if there was any way I could get it back but sadly, I would have had to start again from scratch.

20:11

I persevered and I managed to get roughly what I was looking for. I did think there would be a bit more help as standard and that I wouldn't be using the Gutenberg drag and drop page builder as much. There was WonderBlocks, a selection of template sections for your site.

WonderBlocks is neat tool that lives in the top left corner and contains loads of templates for things like headers, hero images, forms, galleries, testimonials, and a whole bunch of other stuff.

I actually have to praise Bluehost for this - I like this tool a lot. I think the overall user experience is still limited due to the WordPress page editor, but this helps out a lot.

To use one of the templates, you just need to click the plus sign under the template an it adds it to your page. Then you can edit it and move it around.

I used it to create a subscription plan section for my site. I saved a lot of time and frustration doing it this way.

Earlier, I criticised Bluehost for not having any templates and just offering the AI website builder but actually I think it's better this way. You get a very simple and workable layout from the AI page builder and then you get to customize it with template blocks.

32:45

That's enough of page building

The control panel at Bluehost is very clean - the most technical things are all hidden from you, and a lot of the site management tools are integrated into the WordPress CMS rather than hosting panel.

While I was in there I did a quick speed test using a free tool from Google - you'd be foolish to use this as the main testing tool, but it's good for basic diagnostics and from Google itself.

I don't usually do speed tests when I do a One Hour With because I do more thorougher testing in the full review but I was curious and this took a second. It showed only moderate performance for Speed Index which could be because of what I call plug-in bloat.

I followed Google's guidance on how to improve Speed Index and disabled 3rd party plugins, before running the speed test again and immediately seeing a jump in performance.

I think the tools are not necessary to have on all the time, as I don't think I need to monitor my SEO score constantly and there are ways to monitor website traffic with less overheads. For example, you can just paste a Google URL into your page that monitors traffic rather than using a plugin.

The Google Workspace integration took my interest for a while. Obviously, most of these Google tools are free and you can (like I have previously) integrate these things into your website without paying for it.

For example, if you want to take a booking you can use Google Calendar with a standard Gmail account but you will need to use the @gmail email address. There are some workarounds that include setting up your own email and then configuring the settings which could save you money.

I cannot make my mind up on what I would do. Obviously it's easier to just pay Bluehost every month and I don't think it's more expensive than paying for your own Google Workspace and then linking the account. In fact, you might get a discount at Bluehost. Email hosting is a bit cheaper but might not come with the same storage space.

In the past I didn't use Google tools or features other than on simple sites I'd set up for recreational clubs.

For professional business websites, I just used email hosting from my hosting provider. This is something that I'm going to look into at a later date. If I was in a rush, I would just pay Bluehost. It's nothing that cannot be changed at a later date.

60:00

Overall impressions

My overall impression of Bluehost is good, and this little poke around has reinforced my belief that Bluehost is best for WordPress out of all the best WordPress hosting options - at least for beginners.

Anyone who requires WordPress hosting for an agency or needs more performance like the best small business web hosting would likely be better off with SiteGround.

Bluehost is obviously all-in on WordPress, and so pretty much everything is geared towards the CMS. Overall, I liked the page building experience. I think the initial templates are a little bland but the WonderBlocks tool really helped add things to the pages with very little hassle, and the management tools were also very straightforward.

Lastly, even though I deliberated over whether I thought the Google Workspace tools were worth it, I do like that Bluehost leans on familiar tools which are in wide use, so people already know how to use them and there are already plenty of tutorials and helpful resources out there.

I managed to set up a site, make some speed optimizations, and get a good feel around Bluehost in an hour and that's the most I've managed to do with most hosts I've tried.

• 10Web announced a new WordPress plugin
• It allows users to create fully white-labeled websites in minutes
• Users can expect increased ARPU and reduced churn, 10Web says

You can now create a WordPress website in minutes, with the help of Generative AI (GenAI), without needing a third-party website builder or AI tool. Everything can be done in WordPress directly, through a chat interface, and without the website builder’s branding showing anywhere on the site.

This is all courtesy of one of the best website builder platforms 10Web, which just announced the launch of its fully white-labeled AI website builder solution. It comes in the form of a WordPress plugin, and allows users to create a website inside their hosting stack without relying on a separate builder platform.

In a press release shared with TechRadar Pro earlier this week, 10Web says the new offering should further increase ARPU, reduce churn, and differentiate through same-day AI website delivery.

“Hosting companies have been stuck selling blank WordPress installs,” said Arto Minasyan, Founder and CEO of 10Web. “With this solution, they can launch fully functional websites under their own brand in seconds. It’s the simplest way to deliver real customer value, without changing how they host or deploy WordPress.”

WooCommerce included

Usually, when a customer buys a hosting service, they get either a blank WordPress dashboard, or one bundled with themes and plugins. However, with the emergence of GenAI, expectations changed, and customers have gotten used to the “describe and build” experience, the company claims.

That being said, it claims “early tests” showed users being 30% more likely to publish their site compared to traditional WordPress onboarding flows. It didn’t say when the tests took place, who was tested, and against what, though.

In any case, 10Web says the plugin is built on its proprietary AI technology which leverages advanced models from OpenAI, Gemini, and Anthropic. The sites are mobile-friendly, fully structured, and based on a “simple business description”.

When users create a site, they will see a branded AI flow that generates the entire website, including WooCommerce integration, if needed. Finally, everything is white-labeled with the hosting provider’s name and logo, and includes a visual editor with AI Co-Pilot.

More from TechRadar Pro

• 10Web claims its new AI tool can help you build an online store in just 10 minutes
• Check out our roundup of the best AI website builders on the market
• Learn more about Wix with our full Wix review

When it comes to the best website builder platforms, there are countless choices. But, Wix and WordPress.com stand out. They’re the go-to website builders for people who don’t want to mess with code.

Wix focuses on drag-and-drop simplicity while WordPress.com brings more plugin options for power users. And in response to the AI boom, both have responded with sleek new features that offer personalized assistance for design and content.

If you're wondering if there's a clear winner, the answer's a bit complex. While we think that Wix does beat WordPress.com overall, there are at least some use cases that the latter is better suited for. Let's get into all of that now.

Wix vs WordPress: A detailed breakdown

Wix vs WordPress: Features

Wix packs its builder with ready-to-use tools, live drag-and-drop editing, AI-powered layouts, and a huge template gallery covering almost any niche you can imagine. You get built-in ecommerce, booking systems, blog tools, and an App Market full of extra add-ons. Wix’s new AI features handle everything from social media posts to automated loyalty programs, all inside a slick dashboard designed for business growth.

WordPress.com, on the other hand, thrives on its extensibility. The platform starts simple, but its backbone is a library of thousands of themes and plugins. Need an online store, email integrations, SEO, advanced security, or custom workflows? There’s probably a plugin for that. The latest update introduces smarter AI design tools and performance boosters, like native caching, lazy loading, and automated design tweaks. This keeps WordPress.com fast and flexible, while new AI services make it easier to add tailored features as your business grows.

So which one's ultimately better? If you want turn-key features out of the box that can be customized easily, Wix is the best bet. WordPress.com is the better pick if you love tinkering and want to endlessly add or swap advanced tools as your needs change.

Wix vs WordPress: Ease of use

Wix wins hearts for its speed and simplicity. From account setup to website launch, you’re always guided. Just pick a template or let the AI Builder do the heavy lifting by answering a few questions. Its visual editor is pure drag-and-drop, no coding needed. Menus, text, images, and even ecommerce features are all added in real-time, with instant previews. Updates, hosting, and security are handled behind the scenes, giving you more time to run your business.

WordPress.com has improved ease-of-use, but it still requires a more hands-on approach. You’ll need to choose a plan, pick a theme, and configure plugins for basic features. The Gutenberg editor gives you block-based visual editing with AI assistance, plus there are good setup wizards. But when it comes to deep customization or adding ecommerce, be prepared for extra reading and tweaking. Advanced features are robust, but they come with a steeper learning curve, especially for total beginners.

If you want a website up today with no headaches or homework, Wix is again the better choice. If you don’t mind digging in and want to learn as you build, WordPress.com pays off in flexibility and skills learned.

Wix vs WordPress: Support

Wix gives you 24/7 direct help for everyone, including free plan users. You get live chat, phone support, a big help center, video tutorials, and step-by-step guides. It’s direct, fast, and personal, great if you need help now or have urgent questions. You even get dedicated resources for new products like Wix Studio and App Builder.

WordPress.com divides support options by plan. Free users rely on extensive guides, community forums, and documentation. Paid users get access to human support, including live chat with company experts. They also offer AI-powered help for common issues now. But the WordPress ecosystem is huge, so the forums are always bustling.

In short, Wix makes it easier to get one-on-one help at any level. WordPress.com gives more flexibility for self-starters, but direct support is better on paid plans.

Wix vs WordPress: Pricing and plans

Wix’s pricing is straightforward, if a bit higher upfront. The free plan lets you build with limited features and Wix ads. Paid plans start at $17/month for essentials, $36/month for small stores, and up to $159/month for advanced business needs. Each step unlocks extra features, from custom domain to greater storage, advanced analytics, and ecommerce tools. You can stay free as long as you want, but most growing businesses need a paid plan for full branding and upgrades.

WordPress.com starts lower, with a free plan and paid options from $4/month for personal use. The $8/month premium plan adds custom domains and themes. The $25/month business plan unlocks plugins, advanced SEO, and full design flexibility. This is followed by an ecommerce plan and a much pricier enterprise plan. Costs can rise if you add third-party plugins or premium themes, but you get more control of your spending for smaller budgets.

If you prefer one flat fee and lots of built-in tools, Wix has clearer pricing. WordPress.com offers better value when you're starting small and scaling over time.

Wix vs WordPress: Final verdict

So, which builder comes out on top? Wix is perfect if you want simplicity, fast setup, and loads of built-in features. You just drag, drop, and go. WordPress.com is better for those who want deeper customization and more control, especially if you don’t mind spending time learning and tweaking. You can start small and scale as your business grows.

In the end, it’s about your needs: choose Wix for ease and WordPress.com for flexibility. Either way, our guide should help you match specific features and pricing details to your current requirements.

Wix vs Shopify: FAQs

• Makes changes to your website using natural language
• SEO optimize your site
• Woo-commerce ready

I like WordPress. I do! What's not to like? It's free, it's used by basically everyone so there's so much help available, and it's supported by all the best web hosting providers. There is just one thing about it that I, and others, find incredibly frustrating. The page builder.

Now, thanks to Hostinger, those pains will hopefully be over because Kodee, Hostinger's AI management tool, is going to be released with direct integration with your WordPress site.

Knock Knock. Who's that? It's Kodee helping you with WordPress

I've built WordPress sites before but I'm not a website building expert covering the best website builders like my colleague Owain Williams. My area is more website infrastructure (hosting, domains, that sort of stuff) but I do occasionally have a dabble in WordPress because I want to know more about it when recommending the best WordPress hosting.

In my most recent dives into WordPress for my one hour with series, covering what it's like to buy and set up a website with web hosting providers I encountered many beginner WordPress issues after I had purchased and set up a server.

• Hostinger in 60 minutes: Learn from these rookie mistakes
• Dreamhost in 60 minutes: slow server installs but neat business features
• Kinsta in 60 minutes: Is this host good for your agency?

The issue I mostly encountered was working my way around the WordPress block editor Gutenberg. Any time I wanted to remove a button from a template, modify a title, or change how a page element appeared I found myself spending 15 minutes trying to locate a button and then another ten undoing all the mess that pressing that button achieved.

Kodee promises to relieve users of these frustrations as soon WordPress users should be able to modify and edit a page just by asking Kodee to do it for them.

Kodee is not quite ready yet

Earlier in the year Kodee was released to be used as an AI sysadmin tool for VPS servers helping users manage their environment with natural language. For WordPress management Kodee is expected to be released in August.

When it is released Kodee will be able to add pages and posts, edit the text and layout of a page including adding new sections, replace images and content, plus manage settings, plugins, and many other site tasks.

Available on Hostinger Business and Cloud hosting plans

Kodee won't be available on Hostingers lower-end plans such as the single site plan (not available in all regions) and the Premium hosting plan. This means that you'll need to pay at least an extra 0.78$/mo for the first 38 months and then and extra 3$ a month after to use the tool if you didn't intend on buying one of the more powerful plans.

In my opinion, that's a worthy investment if like me, you're not very page builder savvy.

You might also like

• Read about my time at the WordCamp Europe event
• My list of the best managed WordPress hosting providers
• Learn more about WordPress hosting

• Alone – Charity Multipurpose Non-profit WordPress Theme has a 9.8/10 flaw
• The bug allows crooks to create rogue admin accounts
• More than 120,000 takeover attempts already blocked

The "Alone – Charity Multipurpose Non-profit WordPress Theme", a commercial theme used in many WordPress websites, contained a critical vulnerability that allowed threat actors to completely take over the website, experts have warned.

The WordPress theme, designed for charities, NGOs, and fundraising campaigns, features more than 40 ready-to-use demos, donation integration, and compatibility with Elementor and WPBakery.

According to Themetix, around 200 active WordPress sites are running this theme today.

Ongoing attacks

Wordfence researchers claim exploitation started on July 12, two days before the vulnerability was publicly disclosed. So far, the company blocked more than 120,000 exploitation attempts from almost a dozen different IP addresses.

In the attacks, the threat actors try to upload a ZIP archive with a PHP-based backdoor that grants them remote code execution capabilities, as well as the ability to upload arbitrary files. Crooks also used the flaw to deliver backdoors that can create additional admin accounts.

All versions up to 7.8.3 contained a vulnerability that allowed threat actors to upload arbitrary files, including malware that can create admin accounts. That way, crooks can completely take over websites and use them to host other malware, redirect visitors to other malicious pages, serve phishing landing pages, and more.

The vulnerability is now tracked as CVE-2025-4394, and has a severity score of 9.8/10 (critical). It was addressed in version 7.8.5, which was released on June 16, 2025. If you are using this theme, it would be wise to update it as soon as possible, since the bug is being actively exploited in the wild.

WordPress is generally considered one of the best website builder platforms and a safe option, but third-party themes and plugins - not so much. That is why security pros advise WordPress users to only keep the plugins and themes they actively use, and to make sure they are always up to date.

Via The Hacker News

You might also like

• A popular WordPress theme has been hijacked by malware - here's what we know
• Take a look at our guide to the best authenticator app
• We've rounded up the best password managers

• Older versions of Post SMTP allowed hackers to read all emails
• They could also reset the admin password and read the notification email, gaining access to the account
• More than 160,000 WordPress sites are running the vulnerable version

A popular WordPress plugin with hundreds of thousands of active installations carried a vulnerability that allowed threat actors to take over compromised websites, experts have warned.

The plugin is called Post SMTP, a tool that replaces WordPress’s default email function with an authenticated SMTP method, and currently counts more than 400,000 active installations.

Security researchers PatchStack warned an access control mechanism in the plugin’s REST API endpoint was broken, only verifying if a user was logged in, and not checking whether they had permissions to do certain actions, or not. As a result, low-privileged users were allowed access to email logs with full email contents, meaning they were allowed to initiate a password reset for the admin account, view that email, and then log in as the admin, essentially taking over the site.

Patching the bug

The bug was first spotted on May 23, and by May 26, it was already assigned a CVE and a severity score - being tracked as CVE-2025-24000, with a medium severity score of 8.8/10.

Looking at the download statistics on WordPress.org, 59.8% of all Post SMTP installations are running versions 3.1 and newer, meaning 40.2% of sites are still vulnerable.

Since the plugin has more than 400,000 active installations, it means around 160,000 websites can still be taken over using this method.

WordPress is considered one of the best website builder platforms in the world, powering more than half of all sites on the internet and as such, is a popular target for cybercriminals.

However, since WordPress is generally considered a secure platform, crooks are focused on plugins and themes which don’t have the same level of security or support.

That is why most cybersecurity professionals recommend only keeping the plugins and themes that are in use, and always making sure they are up to date.

This issue was fixed in version 3.3.0, published on June 11, 2025, so users should update as soon as possible to ensure they stay protected.

Via BleepingComputer

You might also like

• Another top WordPress plugin hacked to allow account takeover - stay safe with these tips
• Take a look at our guide to the best authenticator app
• We've rounded up the best password managers

There's a lot of buzz around agency hosting these days. It seemed that most of the best web hosting providers wanted to talk about their new agency hosting plans at WordCamp Europe when I attended. It sparked me to write my new best hosting for agencies guide, and when I started my research, I thought there was no better place to start than with Cloudways.

Cloudways has had their Agency Partnership Program since 2021, and it has over 3000 users. It has recently been revamped and relaunched, so I spoke with Fatih Mehtap, VP Marketing, at Coudways about the changes to learn more about the program and what web agencies need from their hosting providers.

What drove the decision to refine and relaunch the Agency Partnership Programme now?

There were two core drivers behind the relaunch. First and foremost, customer feedback. We regularly run pulse surveys, focus groups, and cohort interviews to really understand how our partners feel about the program and where they see room for improvement. A common theme from our agency partners was for us to provide even more support and engagement. The feedback was fair and something we wanted to prioritise.

Relaunching the programme now with renewed vigor is about acknowledging the wants of our partners and recommitting to them with dedicated focus, staffing, and strategic direction.

With over 3,000 agencies already in the program, what feedback shaped these new enhancements?

Our customers wanted more dedicated support, better onboarding, more proactive account engagement, and stronger tools to help them grow.

We’ve implemented dedicated partner onboarding liaisons, offer migration services handled by our engineers, including unlimited free migrations for higher tiers, and quarterly or biannual account reviews. These reviews not only give partners visibility into their tier progression but also uncover potential cost savings or unlock new benefits, like hosting credits and premium support.

How does this refined programme position Cloudways compared with competitors?

Our customers are the driving force behind why we innovate. Every company operates differently, but our focus is to create solutions aligned to our customer needs and wants. From this creation process, there are a few clear differentiators.

At the Gold and Platinum tiers of the programme, agencies get access to unlimited white-glove migrations, removing a major technical and financial barrier to switching and consolidating clients. Combined with a revamped Partner Hub, these features go beyond what most hosts provide, especially for agencies focused on growth. They help simplify operations, reduce overhead, and free up resources, allowing teams to focus more on scaling their business rather than dealing with infrastructure complexities.

Can you walk us through the $15,000+ learning resources package? What specific skills and trends are you helping agencies master?

The learning content originated from UGURUS – a coaching content platform built specifically for agency owners. Before the relaunch, content was curated and sold in different tier packages, starting at around $2,000 per year. We’ve ungated all of this content for the benefit of programme partners.

The learning resources specifically provide a comprehensive range of content supporting agencies at various stages of growth and maturity. This includes guidance on starting and scaling an agency, improving sales techniques, building and maintaining client relationships, mastering outreach strategies and refining internal operations and business development practices. The resources are designed to meet the needs of solo entrepreneurs just beginning their journey, through to established agencies looking to optimise strategies.

What ROI can agencies expect to see through the partnership programme?

Expected ROI from the partnership programme varies based on agency size, goals, and how actively they engage with the benefits. Many partners experience immediate cost reductions through hosting credits and access to premium support, which helps lower their operational expenses, whereas others benefit from long-term loyalty discounts and time-to-market savings.

Through referrals and affiliate commissions, every agency partner can benefit from generating passive income through recurring earnings, and the educational content provides a clear path to scaling up services and refining operations.

Ultimately, agencies can expect to get out what they put in. While some see measurable savings within a single quarter, others are leveraging the programme to unlock entirely new revenue streams, particularly through co-marketing opportunities and long-term client growth strategies. One of the favourite features of our program is the Agency Spotlight and case studies we publish on our website; those get thousands of views every month. Our agencies appreciate the brand visibility.

Can you tell me more about the co-marketing opportunities that come with the programme?

Co-marketing is a key area of opportunity, especially for our top-tier partners. Cloudways is actively looking to collaborate with agencies on webinars, case studies, guest blog posts, and social promotions. If a partner is doing outstanding work powered by a Cloudways solution, we want to help amplify their story and provide visibility across our channels.

It’s about building a mutually beneficial spotlight. One that not only shows off the partnership’s great work, but also drives leads, credibility, and reach for both sides.

Over the course of the Calendar year, we run multiple virtual and in-person events, using these platforms to invite customers to take part and share their perspective on what’s happening in the industry.

How is the agency hosting landscape evolving, and where do you see the biggest opportunities?

Agencies are no longer just service providers; they’re becoming strategic digital partners to their clients. The shift means they need infrastructure that’s flexible, scalable, and backed by responsive, knowledgeable support. Many of our customers come to us because they want more control and accessibility to how they run their hosting. We help

them evolve their offering through greater choice, flexibility, and scalability, capabilities not every hosting provider can provide.

The opportunity for agency hosting lies in serving those evolving needs. That’s why we’re leaning into things like robust learning tools, premium service layers, and scalable partner incentives. Agencies want to grow, diversify, and build more sustainable income models, and we’re aligning our platform and programme to support that evolution.

What are the main differences between the support levels?

Support is structured in tiers, with each level offering increased access to premium services.

Bronze and Silver partners receive standard 24/7 support, including chat-based troubleshooting for day-to-day issues. As agencies move into the Gold and Platinum tiers, they unlock advanced and premium support features such as faster response times, dedicated squads, more proactive issue resolution and advanced troubleshooting assistance.

At the Platinum level, support becomes even more hands-on. It includes deeper technical involvement like multi-site performance optimisation and infrastructure tuning, often delivered through senior, tenured migration and onboarding specialists.

Ultimately, our aim is to remove any ambiguity. Partners know that we are a help desk inquiry away and that helps them build confidence to experiment on the platform. Partners always know exactly what level of support they’re receiving and how it aligns with the complexity of their operations.

You might also like

• WP Engine vs Kinsta: Whats best for your agency?
• One Hour with Kinsta
• The best cloud hosting providers

• Experts find a way to trick Forminator into deleting a core WordPress file
• This process would trigger the site's setup, where hackers can take it over
• A patch is available, and users are advised to apply it

A popular WordPress plugin active on hundreds of thousands of websites was found to be carrying a high-severity vulnerability which could allow threat actors to fully take over compromised websites.

Forminator is a website builder plugin which allows WordPress operators to add custom contact, feedback, quizzes, surveys, polls, and payment forms. Everything is drag-and-drop and thus user-friendly, and plays well with many other plugins.

Recently, a security researcher with the alias ‘Phat RiO – BlueRock’ found the plugin had insufficient validation and sanitation of form field input vulnerability, as well as an unsafe file deletion logic. It could be abused to insert a custom file into any field, which would (after a few steps) force Forminator into deleting the core WordPress file. As a result, the entire website enters the “setup” stage, where the attacker can take it over.

How to stay safe

“Deleting wp-config.php forces the site into a setup state, allowing an attacker to initiate a site takeover by connecting it to a database under their control,” noted experts at Wordfence, a WordPress security project.

The vulnerability is tracked as CVE-2025-6463, and has a severity score of 8.8/10 - high. All versions up to 1.44.2 are vulnerable. As per Wordpress.org data, there are more than 600,000 active websites using this plugin, making the attack surface rather large.

The first clean version is 1.44.3, and the plugin’s vendors, WPMU DEV, is urging all users to apply it as soon as possible. BleepingComputer says since the patch was released, the plugin was downloaded 200,000 times, “but it is unclear how many are currently vulnerable to exploitation”.

To mitigate the risk of attack, website admins should upgrade their Forminator plugin to the newest version, or disable and delete the plugin altogether. Generally speaking, WordPress as a platform is considered safe, with various plugins and themes being the weakest link in this security chain.

That being said, WordPress users are advised to only keep those plugins and themes that they’re using, ensuring these are updated regularly, while disabling and deleting all others.

You might also like

• A critical security flaw could affect thousands of WordPress sites
• Take a look at our guide to the best authenticator app
• We've rounded up the best password managers

So, non-human visitors are not exactly new. Bots have been scrolling the web since the 90s but search is changing and evolving and website owners now need to start preparing for AI agents visiting their site too.

Don't believe me? Jason Mayes, Web AI Lead at Google, recently spoke at WordCamp Europe saying: "We're now entering the age where AI agents are growing in popularity". Hostinger, one of the best web hosting providers, believe it too and have recently launched a new tool to automatically create an LLMs.txt file for WordPress sites.

AI agents are powered by Large Language Models (LLMs) such as Google's Gemini, Anthropic's Claude, and OpenAI's ChatGPT. These models can seemingly read and understand text like a human but there are things we can do to help them understand websites better. Just like how robots.txt and sitemap.html help traditional search methods navigate and understand websites, LLMs.txt severs the purpose for AI agents.

To learn more about AI agents, LLMs, and how they're shaping search, I spoke to Saulius Lazaravičius, VP of product at Hostinger, about the new tool to create LLMs.txt files.

So, what is LLMs.txt, and how is it related to search and site visitors?

Traditionally, people find information online through search engines like Google, which rely on robots.txt and sitemap.xml files to navigate and index content. But with the rise of AI tools like ChatGPT and Claude, more users now get answers directly from large language models (LLMs), bypassing traditional search.

That’s where LLMs.txt file comes in. It serves as a map for AI systems, helping them identify and understand the most important parts of a website. LLMs.txt file provides:

• A clear, prioritized list of the site’s key pages
• Concise summaries for page content
• Links to more detailed, authoritative resources

Placed alongside robots.txt and sitemap.xml, the LLMs.txt file improves how AI engines interpret complex site structures – potentially increasing a site's visibility in AI-generated answers.

Is there currently any data that shows the benefit of having LLMs.txt alongside robots.txt and a sitemap.xml?

Currently, adoption of LLMs.txt is still in its infancy, with fewer than 1% of the top one million websites using it as of early 2025. However, the share of traffic coming from AI platforms is constantly growing. For example, usage of AI-driven search among adults in the US is projected to more than double by 2028.

While hard data on LLMs.txt effectiveness is still emerging, the broader concept of "SEO for AI" – also known as generative engine optimization (GEO) – is gaining traction. Website owners are increasingly looking for ways to make their content more accessible and relevant to AI systems. LLMs.txt is an early, proactive step in that direction.

What makes a good LLMs.txt file, and how do you achieve this through one click?

A well-structured LLMs.txt file is clean, simple, and focused on surfacing a site’s most valuable content for AI systems. It typically begins with the website’s main address, followed by selected pages that AI models should prioritize. Optional descriptions can be added to clarify the content structure or hierarchy.

The file is hosted at the root of the website (e.g. domain.tld/llms.txt) and is easy to set up – especially with automated tools like our one-click LLMs.txt file creator.

Importantly, implementing an LLMs.txt file has no negative impact on traditional SEO. It’s a forward-looking, proactive step that makes a site more accessible to AI tools – both now and in the future.

How soon do you see LLMs.txt becoming a web standard?

With AI playing a growing role in how people discover content, more businesses will need to optimize websites not just for search engines, but for AI systems as well. This adoption is expected to increase significantly in the next few months or years.

It’s still unclear whether LLMs.txt will become a long-term standard. It might evolve into something more sophisticated, like NLWeb or API-driven solutions. But the concept of making content easily digestible for AI is here to stay.

At Hostinger, we’re committed to giving our customers a competitive edge. That’s why we were among the first to offer automatic LLMs.txt file creation, and we’ll continue evolving our tools as the GEO landscape changes.

Are there any other things website owners can do to improve their site visibility to AI?

Like traditional search engines, AI systems look for valuable, high-quality content. That means creating genuinely helpful information for people, ensuring the site is fast, mobile-friendly, and easy to navigate, and making the content technically accessible for crawling and indexing.

Each website owner should understand that AI-backed browsing is here and it’s growing. That means they must constantly check what’s new in the field of GEO and look for tools that expose their website content for LLMs. Today, LLMs.txt is a strong first step.

Looking ahead, we believe that websites may evolve toward Model Context Protocol (MCP) interfaces, where content isn’t just displayed for humans but served via MCP-compatible APIs, and AI agents will consume it on users’ behalf.

You might also like

• Looking for the best WordPress hosting?
• Or simply want to learn more about WordPress?
• There's also my round-up of the best VPS hosting providers

The best Web hosting companies all support WordPress and there are even specialist hosts which pride themselves on providing the best WordPress hosting but what even is WordPress? WordPress is a Content Management System (CMS) that helps people build and manage websites.

But hat might not necessarily answer your question. How does it do that? What's a CMS? What do I need to know when making a WordPress site? Fear not, all those questions are answered here.

What Is WordPress? Explained For Beginners

WordPress is a popular and free content management system with a page builder that lets you build and manage websites with zero coding experience. WordPress powers approximately 40% of all websites on the internet, so you can rest assured that it’s reliable.

You get various building blocks, like text sections, image galleries, contact forms, and navigation menus, that you can arrange and customize to create your desired website. This simple approach makes website creation easier for people without coding or technical experience.

To understand it better, think about how you order furniture from IKEA, and when it gets delivered to your home, you read the manual and start assembling it as per the instructions. It’s the same for WordPress. You pick the pieces and assemble, and the final furniture is your website.

Did you know: WordPress initially began as a tool to publish blogs, but later evolved to publish other web content too?

Types Of Websites You Can Make with WordPress

You can create any type of website with WordPress, right from a personal blog, news, to even fully-fledged eCommerce stores. WordPress gives you 7,500+ themes to choose from with one-click installation and tons of blocks, so the possibility to design a website you desire is infinite.

• News and Magazine Sites: Publishing organizations appreciate WordPress's content management capabilities, editorial workflows, and multi-author support systems. You can use its built-in template and edit it to fit your brand guidelines.
• E-commerce Stores: Through the WooCommerce plugin, WordPress can be turned into a powerful e-commerce platform. You can sell physical products, digital downloads, or services directly through your website, complete with shopping cart functionality and payment processing.
• Personal and Professional Blogs: WordPress began as a blogging platform and continues to excel in this area. You can create blogs for sharing personal experiences, professional insights, or specialized knowledge in your field of expertise.
• Educational Websites: Schools, training organizations, and individual educators can create learning platforms using WordPress. These sites can include course materials, student resources, and interactive elements.
• Portfolio Websites: Creative professionals such as photographers, designers, and artists use WordPress to showcase their work. The platform offers numerous portfolio-focused themes that highlight visual content effectively.
• Business Websites: Service-based businesses, consultancies, and local companies use WordPress to establish their online presence. These sites typically include service descriptions, team information, testimonials, and contact details.

The list of websites you can make with WordPress is endless, and we mean it. The templates you get are a starting point, and you can begin customization as per your requirements.

WordPress.com vs WordPress.org

If you’re new to the WordPress world, the confusion between WordPress.com and WordPress.com might make you think they’re the same.

WordPress is a CMS and is available for free at WordPress.org. It is also usually pre-installed or available via a one-click installer on most shared hosting plans, where it is also free. You do not and never will need to pay for WordPress. However, you do need to pay for hosting, and maybe a page builder if you don’t get on with Gutenberg (the WordPress page builder), and may pay for some plugins.

WordPress.com, on the other hand, is a hosting company that is owned by Automattic, the company behind WordPress. An important difference between the two to remember here is that using WordPress does not require WordPress.com. Many web hosting companies offer WordPress installation and support and provide better value and more flexibility than WordPress.com's hosting services.

Is WordPress easy to use for a beginner?

Yes and no. Some get on with it right away. Others find the page builder hard to use. I personally have found the page builder hard to use, since I came from zero tech experience or knowledge. When I began building my site, I had to go through tons of tutorials, and there was a higher learning curve.

At the same time, it also depends on the template you use. Everyone’s experience is different with WordPress. For instance, someone with a tech background or a little bit of know-how can pick up WordPress easily with a bit of experimentation here and there.

So, labelling it easy or difficult would be unfair. More likely, we’d say, it depends on one user to another. And let’s be real here. Most beginners can create a basic website within a few days to a week of dedicated learning. However, developing proficiency with advanced features typically requires several weeks or months of regular use.

It’s exactly like you’re building with Lego. Some people are so good and fast at it that it doesn’t take them long. While some people build it, it takes them days to finish it. The same is the case with using WordPress.

A bonus of WordPress being so popular is that there are tons of tutorials. So if you are struggling, you should be able to find help and figure out how to use WordPress on your own, with plenty of helpful guides out there.

How Much Is WordPress?

WordPress is free to use. However, running a website does involve some costs, such as:

• Hosting
• A domain
• Plug-ins (optional)
• Page builders (optional)

Let’s break down this in a more detailed manner below:

Important/Mandatory Expenses

Web Hosting: $60-180 annually

The best web hosting provides the server space where your website files are stored and accessed by visitors. Shared hosting plans typically cost $2-15 monthly, while more robust hosting options range higher. When I was building my site, I went with Hostinger, and it cost me $2.99/month for the Shared Hosting plan. In the initial stage, shared hosting is usually the best and economical option. The best WordPress hosting is often shared hosting with a hosting provider that has dedicated support for WordPress and servers optimized for WordPress too.

Domain Name: $10-15 annually

Your domain name serves as your website's address on the internet. This annual fee registers your chosen domain name and maintains your rights to use it. Domain names often come free with your hosting provider for one year but I always recommend shopping around the best domain name registrars for a better overall deal.

Optional Expenses

Premium Themes: $30-100 (one-time purchase)

While free themes are available, premium themes often provide additional customization options, better support, and more sophisticated designs.

Premium Plugins: $50-200+ annually

If you want advanced features on your website, you’ll need premium plugins. These might include enhanced security features, advanced SEO tools, or specialized business applications.

Professional Page Builders: $50-200 annually

If you find the default WordPress editor challenging, third-party page builders like Elementor or Divi offer more intuitive design interfaces.

Professional Services: Variable costs

Some users invest in professional setup, design customization, or ongoing maintenance services. If you choose to opt for that, you can expect additional charges for these, depending on which services you go for.

Reasons to Use WordPress

• Free to use, so you don’t have to ever worry about paying separately
• Can migrate anywhere without losing content or functionality
• Provides excellent support & guidance from the vast global community
• Exceptional scalability so you can scale your website as it grows
• Regular updates for continuous development

Disadvantages of WordPress

• There is an added level of management compared to page builders
• The Gutenberg page builder could be easier to use
• There are currently some legal battles going on that are disrupting the WordPress community
• With thousands of available plugins, compatibility conflicts can occasionally occur
• As a self-hosted solution, you're responsible for implementing security measures

Final Words

WordPress is a powerful CMS that provides extensive customization and blends affordability and scalability in one. While there is a learning curve, you can use this free CMS to build your website and learn through its strong community support.

Choose WordPress If You Need:

• A scalable website
• A free CMS
• Complete control over your website's design and functionality

On the other hand, you might want to consider an alternative if you’re looking for something very easy to use with zero learning curve or minimal technical involvement in website management.

• 'Motors' WordPress theme vulnerability leaves accounts open to takeover attacks
• Widespread attacks were observed from June 7 onwards
• A patch is available in version 5.6.68, so update now

A popular premium WordPress theme, has been exploited by hackers thanks to a critical privilege escalation flaw tracked as CVE-2025-4322.

Attackers are able to exploit the vulnerability in the 'Motors' theme to hijack administrator accounts, taking full control of sites to change details, inject false details and spread malicious payloads.

Developed by StylemixThemes and a popular pick among automotive websites, nearly 22,500 sales of the theme have been logged on EnvatoMarket.

'Motors' WordPress theme has been hijacked

The vulnerability had first been discovered on May 2, 2025, with a patch later released with version 5.6.68 on May 14, meaning that up-to-date accounts should be protected from potential account takeovers. Versions up to 5.6.67 are affected by the CVE, with Wordfence reporting on the details on May 19.

"This is due to the theme not properly validating a user's identity prior to updating their password," Wordfence explained.

"This makes it possible for unauthenticated attackers to change arbitrary user passwords, including those of administrators, and leverage that to gain access to their account."

Although the patch has already been released, accounts that are still running older versions are at risk of takeover, with attacks seen to have started on May 20. By June 7, researchers were observing wide-scale attacks – Wordfence has now blocked more than 23,000 attack attempts.

Wordfence also disclosed a number of key IP addresses seen to be attacking sites – many making thousands of attempts each.

"One obvious sign of infection is if a site’s administrator is unable to log in with the correct password as it may have been changed as a result of this vulnerability," the researchers explained.

The biggest change users of the 'Motors' theme can do is to update to version 5.6.68, closing the vulnerability to attackers and securing their accounts from takeovers.

Via BleepingComputer

You might also like

• We've listed the best firewall software
• Critical security flaw could leave over 100,000 WordPress sites at risk
• Keep track of your multi-factor authentication codes with the best authenticator apps