wpbob.com - WordPress, built like it matters

A web form with one list row glowing amber sends a cube marked with the PHP elephant toward two pipes; a blue shield blocks the upper pipe, while an amber arrow enters the open, older lower pipe

Gravity Forms CVE-2026-103039: One Missed Call, a 9.8, and Who’s Actually Exposed

If you run Gravity Forms, make sure it’s on 3.1.3 or later. The current version is 3.2.1. Then check whether any form creates posts using a List-type custom field. On October 30, three vulnerabilities in Gravity Forms were published, all open to visitors with no login. The worst, CVE-2026-103039, is scored 9.8: an anonymous form […]

A div tag with id and class attributes passes through a glowing shield checkpoint; on the far side, a teal wire labeled data-state plugs into the tag and swaps its class attribute for data-state=open, surrounded by data-attribute labels

WordPress 7.1.4: 18 Security Fixes and What They Mean for Your Blocks

A browser window squeezed in a metal press, with a row of blue percent-sign tokens; one amber token is cracked open and a dotted amber line runs from it to an image icon

LiteSpeed Cache CVE-2026-116763: Two Stored XSS Bugs, Two Settings to Check

Latest articles

CVE Watch Oct 28, 2026

ACF Extended CVE-2026-94267: Five Front-End Form Flaws, One Root Cause

A storefront web page with an upload box as a red code file flies into it, beside a checklist that ticks image files and marks a code file with a red X, with a shopping cart and a warning sign

CVE Watch Oct 27, 2026

Wholesale Lead Capture CVE-2026-27540: Patched in February, Attacked All Summer

A red code file following an empty dashed file into a web upload form, with a warning sign and red cracks spreading across the server stack behind it

CVE Watch Oct 27, 2026

Elementor Pro CVE-2026-32475: Form Uploads Turned Into Site Takeovers

A website on a server at the center of a network of connections to a key, a cloud, a user, a clock and another window, with a magnifying glass inspecting a checklist

Development Oct 26, 2026

Auditing Remote Access to WordPress with WP-CLI

A swarm of projectiles shattering against a tall glowing wall that protects a row of servers behind it

Blog Oct 26, 2026

PHP2Shell, One Week Later: Millions of Attacks, No Confirmed Break-Ins

A cloud dashboard holding a key, connected to many WordPress sites, while a hand takes a glowing red copy of the key and red bug icons appear on some of the connections

CVE Watch Oct 23, 2026

UpdraftCentral Breach: Stolen Keys Used to Backdoor WordPress Sites

Scattered code fragments pouring into a funnel and coming out the bottom as clean HTML tags: div, p, a, ul, li and img

Development Oct 22, 2026

wp_kses() Rebuilt on the HTML API: What Changes in WordPress 7.2

An image tag going into a gear-driven machine and coming out the other side cracked open, with an orange code symbol breaking out of it

CVE Watch Oct 22, 2026

WebP Express CVE-2026-97328: When the HTML Parser Writes the Attack

A server with a power dial and a shield supporting a stack of layers: a website, plugins, and WordPress on top

Blog Oct 22, 2026

Your Host’s PHP Version Is a Security Setting

Explore popular topics

CVE Watch

Development

Blog