duke42 Security scan & fix Ongoing care
← Back to Duke42

WORDPRESS REPAIR & SECURITY

Get your WordPress site back on track.

Hacked pages, unexpected redirects or overdue updates? We check WordPress, its plugins and the hosting behind it.

See recent security issues ↓

One-time repair

FIX NOW

Previously €199 Now €99 / one-time repair

Core, plugins and themes · Backup · Repair or update · Login, forms and key pages

Money-back guarantee. If we can’t fix your problem, we’ll refund your payment in full. Prices in EUR; VAT added where applicable.

FREE WEBSITE CHECK

Find your website’s security risks

Recent security issues

7 selected records

24 Jul 2026 – 24 Oct 2026 · Sources checked 24 Oct 2026

Selected WordPress core security fixes. Plugin and theme advisories are not included in this list; we check installed components separately. This is a selected list, not a complete vulnerability inventory or a scan of your system.

Security release

WordPress 7.1.3

Stored scripting in pending comments

A pending comment could inject script into the comments administration screen.

Affected systems & fix
Applies to
Core installations missing the relevant security fix. Conditions vary by issue.
What fixes it
Upgrade to a supported release containing the 7.1.3 fixes; verify any backport explicitly.
Official source ↗
Security release

WordPress 7.1.3

SQL injection in WXR exports

A second-order SQL injection affected the export process.

Affected systems & fix
Applies to
Core installations missing the relevant security fix. Conditions vary by issue.
What fixes it
Upgrade to a supported release containing the 7.1.3 fixes; verify any backport explicitly.
Official source ↗
Security release

WordPress 7.1.3

Private comment disclosure

Unauthenticated visitors could obtain comments on private or unpublished posts.

Affected systems & fix
Applies to
Core installations missing the relevant security fix. Conditions vary by issue.
What fixes it
Upgrade to a supported release containing the 7.1.3 fixes; verify any backport explicitly.
Official source ↗
Security release

WordPress 7.1.2

Template resolution can lead to code execution

An unauthenticated request could include a readable local PHP file outside theme directories.

Affected systems & fix
Applies to
Requires specific server and active-theme conditions.
What fixes it
Apply the 7.1.2 fix or a later supported security release.
Official source ↗
Security release

WordPress 7.1.1

Stored scripting and authorization gaps

The release fixes content-editing XSS, authenticated template path traversal and unauthorized post changes.

Affected systems & fix
Applies to
Affected core functionality; required permissions differ between fixes.
What fixes it
Install a supported release including the 7.1.1 security fixes.
Official source ↗
Published

CVE-2026-65640

Uploaded files can trigger code execution

An Author-level account or higher could use a malicious upload to run code.

Affected systems & fix
Applies to
Sites using Imagick and Ghostscript on affected WordPress versions.
What fixes it
The 7.0.4 release contains the fix; use a supported release including this and subsequent patches.
Official source ↗
Published

CVE-2026-64638

Login-screen reflected scripting

A pre-authentication XSS issue could potentially lead to PHP code execution.

Affected systems & fix
Applies to
Affected WordPress login-screen code.
What fixes it
The 7.0.3 release contains the fix; update to a supported release with subsequent patches too.
Official source ↗

Not sure which issues affect you?

Send the site or server address and a working contact. We’ll check the installed versions and configuration before making changes. Missing access? Tell us what you have.

Keep it maintained afterwards. Care from €29/month ↗

LET’S GET IT WORKING

What happened?

Tell us what happened and how to reach you. We’ll arrange access separately — don’t share passwords here.

Can’t access it or don’t know the address? You can still ask for help.

Use another email or your phone if your website’s email is down.

Add details or available access optional

We’ll use your details to respond to this request. Access credentials are arranged separately.