CVE-2026-82901 in Ultra Addons for Contact Form 7
Ultra Addons for Contact Form 7 up to 3.5.50 lets unauthenticated visitors upload arbitrary files via a signature field. Update to 3.5.51 or later. Affected component: Ultra Addons for Contact Form 7 (plugin) Fixed in: 3.5.51 PowerSEC coverage: PowerSEC detects the affected…
CVE-2026-19859 in JetFormBuilder
JetFormBuilder before 3.6.5.2 lets unauthenticated visitors run arbitrary shortcodes through its 'status' parameter. Update to version 3.6.5.2 or later. Affected component: JetFormBuilder — Dynamic Blocks Form Builder (plugin) Fixed in: 3.6.5.2 PowerSEC coverage: PowerSEC…
CVE-2026-84750 in Ultra Addons for Contact Form 7
Ultra Addons for Contact Form 7 3.2.4 to 3.5.50 lets unauthenticated visitors upload arbitrary files through a form field. Update to 3.5.51 or later. Affected component: Ultra Addons for Contact Form 7 (plugin) Fixed in: 3.5.51 PowerSEC coverage: PowerSEC detects the affected…
CVE-2020-11738 in Duplicator and Duplicator Pro
Duplicator before 1.3.28 and Duplicator Pro before 3.8.7.1 let unauthenticated attackers read any file on the server. It is being exploited; update now. Affected component: Duplicator Pro and Duplicator (plugin) Fixed in: 3.8.7.1 (Duplicator Pro), 1.3.28 (Duplicator) Known…
CVE-2020-25213 in File Manager
WP File Manager 6.8 and earlier lets unauthenticated attackers upload and run PHP files. It has been exploited in the wild; update to 6.9 or later now. Affected component: File Manager (plugin) Fixed in: 6.9 Known exploited: this CVE is listed in the CISA Known Exploited…
CVE-2026-63030 in WordPress
WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 have a remote code execution flaw in the REST API batch route that is being exploited. Update to 6.9.5 or 7.0.2. Affected component: WordPress (core) Fixed in: 6.9.5, 7.0.2 Known exploited: this CVE is listed in the CISA Known…
Behavioral WAF: learning, monitor, and block modes
PowerSEC's Behavioral WAF is an optional signature layer on top of the core firewall. It is off by default and has three modes so you can turn it on without breaking your site.
Whole-site malware scanning and webshell detection
PowerSEC's malware scanner reviews PHP-like executable files across your entire WordPress installation, including writable and non-standard directories — uploads, cache, backup folders, and security-plugin log folders — where attackers often hide malicious files. Active…
Does PowerSEC scan for malware automatically?
Yes. As of plugin v1.4.107 PowerSEC runs its full malware scanner automatically in the background on a schedule, in addition to on-demand scans. Available on every plan.
How PowerSEC's malware scanner stays safe
PowerSEC's scanner detects malware by static pattern matching and never runs the code it scans.
Why some vulnerabilities are flagged "fix first"
PowerSEC flags vulnerabilities that are confirmed exploited in the wild (CISA KEV) and sorts them to the top so you patch what attackers are actually using first.
Web Application Firewall (WAF) basics
How PowerSEC's firewall layers inspect requests to your WordPress site, and how to handle a blocked legitimate request.
File integrity monitoring explained
File integrity monitoring (FIM) detects when files on your server change unexpectedly. PowerSEC compares your live filesystem against a known-good baseline. What PowerSEC monitors Two checks make up file integrity monitoring: - WordPress core check (on by default) — once a day,…
Understanding malware types found by PowerSEC
How PowerSEC rates the files it flags, common malware families, and what to do with a malicious file.
Common WordPress attack vectors
The kinds of attacks WordPress sites face, and what PowerSEC does about each one.
Why your WordPress site needs security
WordPress powers a large share of the web, which makes it a common target for attackers. Once your site is online, automated bots will probe it for known weaknesses. What attackers are after - Spam injection — your site sends pharmacy spam without your knowledge, ruining your…
Trigger an on-demand scan
You can start a malware scan at any time, on every plan. Scans run automatically too (see the end of this article), so an on-demand scan is for when you want a fresh result right away. From the site page 1. Open Dashboard → Sites and click the site 2. Click Scan at the top of…