iiinova — where your digital self keeps evolving

WP Security Ninja

@wpsecurityninja.bsky.social

Visit us at wpsecurityninja.com/?utm_source=blu…

WP Security Ninja @wpsecurityninja.bsky.social · 10h

WordPress 7.1.3 is out (Oct 6): 7 security fixes. Update now. Comments admin XSS, WXR SQLi, unauth private comments. Same-day 7.0-6.6; older backports still shipping. wpsecurityninja.com/warnings/?ut...

000

WP Security Ninja @wpsecurityninja.bsky.social · 13h

000

WP Security Ninja @wpsecurityninja.bsky.social · 23/09/2026

If you stopped at Click2Shell / 7.1.1, you are not done. CVE-2026-87902 is unauth LFI in core template resolution. Patchstack saw probes the same day. Update to 7.1.2 or your backport. Hunt logs for odd pagename + page_id. Already patched? Drop a ✅. Agency life? Pass it to your clients.

000

WP Security Ninja @wpsecurityninja.bsky.social · 22/09/2026

WordPress shipped another security release in 5 days. 7.1.1 on 17 Sep. 7.1.2 today (CVE-2026-87902). Update core, then inactive themes and comments. wpsecurityninja.com/wp2shell/?ut...

001

WP Security Ninja @wpsecurityninja.bsky.social · 07/09/2026

If a scanner says core files were modified, open the diff. wp-config.php is normal. PHP in wp-includes you did not edit is not. After wp2shell, that is often leftover access. wpsecurityninja.com/wordpress-co...

000

WP Security Ninja @wpsecurityninja.bsky.social · 01/09/2026

WP Security Ninja 5.302: firewall that stays light. No more options-table bloat per IP on busy sites. Fewer DNS lookups on normal traffic. REST username enumeration blocked. wpsecurityninja.com/?utm_source=...

000

WP Security Ninja @wpsecurityninja.bsky.social · 31/08/2026

wp2shell (Aug 31): nearly 7 weeks later. FortiGuard still lists scanning. Confirm 6.8.6 / 6.9.5 / 7.0.2. Then leftover admins + mu-plugins. Patched is not clean. wpsecurityninja.com/wp2shell/?ut...

000

WP Security Ninja @wpsecurityninja.bsky.social · 25/08/2026

WP Security Ninja 5.300 is out. Fewer false alarms: firewall hostname fix + quieter Security Testing emails. wpsecurityninja.com/changelog/?u... #WordPress #WPSecurityNinja

000

WP Security Ninja @wpsecurityninja.bsky.social · 25/08/2026

wp2shell is nearly six weeks old. Confirm 6.8.6 / 6.9.5 / 7.0.2. Then unknown admins, mu-plugins, PHP in uploads. Patched ≠ clean. wpsecurityninja.com/wp2shell/?ut... #WordPress #wp2shell

000