Subscribe
Share
Share
Embed
Wordfence Security News is a weekly cybersecurity news podcast covering the top news stories from the world of WordPress security and the broader cybersecurity threat landscape. Hosted by cybersecurity expert and Wordfence researcher Alex Thomas.
[0:00] This week on Wordfence Security News.
[0:02] A WordPress plugin exposes API keys and attackers begin mass exploitation across the ecosystem.
[0:08] Suspected state-sponsored attackers exploit a Palo Alto firewall vulnerability.
[0:13] A supply chain Worm hijacks TanStack's release pipeline.
[0:17] And Google identifies the first zero-day exploit developed with the help of AI.
[0:25] This is Wordfence Security News for the week of May 11, 2026.
[0:29] I'm Alex Thomas.
[0:33] Our top WordPress story this week is active mass exploitation of an information disclosure
[0:38] vulnerability in Gravity SNTP, a transactional email plugin from Rocket Genius, the company
[0:45] behind Gravity Forms.
[0:46] The vulnerability sits in a mock data REST API endpoint that the plugin registered without
[0:51] any authentication check, so anyone on the internet can reach it.
[0:55] When an attacker requests that endpoint with the right query parameter,
[0:59] the plugin responds with roughly 365 kilobytes of JSON containing its full system report.
[1:06] That includes server configuration details, active plugin and theme inventory,
[1:11] database information, and any API keys, tokens,
[1:14] or mail service credentials configured in the plugin.
[1:17] The plugin was patched in version 2.1.5 at the end of March.
[1:22] What changed on May 4th was the risk signal.
[1:25] A WordPress site owner posted on the r/WordPress subreddit reporting that the mock data endpoint was exposing their plugin settings and their company's SendGrid account had been closed pending security review after leaked keys were used, prompting rotation of 80 SendGrid API keys.
[1:44] According to Ben Ryan, a WordPress maintenance and security consultant, similar incidents have
[1:50] reportedly involved mail service credentials, including SendGrid and Mailgun, and the exposed
[1:56] system report can include DKIM-related data used for domain authentication. We're treating both as
[2:03] anecdotal third-party reports rather than confirmed causation, but they're directionally consistent
[2:08] with the impact described for this vulnerability. After the Reddit report surfaced, the WordPress
[2:13] team confirmed active exploitation was underway and deployed a firewall rule to block it. Since
[2:19] that rule went live, the Wordfence firewall has blocked nearly 788,000 exploit attempts
[2:25] targeting this vulnerability across more than 77,000 unique WordPress sites. Historically,
[2:31] this class of bug hasn't always translated into large-scale exploitation. What changed here is
[2:36] that public reporting made the operational risk clear, exposed mail service credentials. Once that
[2:43] risk became obvious scanning against the endpoint spread quickly across the WordPress ecosystem.
[2:48] If you're running Gravity SMTP, update to version 2.1.5 or later immediately. And if your site was
[2:55] running an affected version on a publicly accessible domain, treat any credentials the
[3:00] plugin had stored as potentially exposed. That means rotating SMTP passwords and any third-party
[3:07] email service API keys configured in the plugin. Wordfence Premium, Care, and Response customers
[3:13] receive protection May 5th.
[3:15] Sites on the WordPress free tier will receive the rule on June 4th.
[3:19] Our second WordPress story this week is a critical authentication bypass in cPanel and WHM,
[3:25] the control panel software running on a large portion of shared WordPress hosting providers.
[3:31] This vulnerability is now under active exploitation.
[3:34] cPanel pushed a patch on April 28th.
[3:37] The next day, security firm watchTowr published a detailed technical analysis
[3:40] showing how the bug could be triggered.
[3:43] and public reporting said those details could be used to develop a working exploit.
[3:47] The vulnerability is in cPanel's session management layer.
[3:51] According to cPanel, a specially crafted request can cause an unauthenticated session
[3:56] to be treated as authenticated, giving an attacker administrative access without valid credentials.
[4:02] Because cPanel often sits underneath dozens or hundreds of WordPress sites on a shared host,
[4:08] a compromised control panel can put every site on that server at risk.
[4:12] If you're managing WordPress sites on cPanel-based hosting, confirm with your provider that the April patch has been applied.
[4:22] The biggest enterprise story this week is the Palo Alto Pan-OS zero-day, disclosed on May 5th.
[4:29] Palo Alto's Unit 42 team has attributed the in-the-wild attacks to a likely state-sponsored threat cluster.
[4:35] The flaw is a buffer overflow in the User ID Authentication Portal, also known as the Captive Portal,
[4:43] and it lets unauthenticated attackers execute code as root on PA series and VM series firewalls.
[4:50] Prisma Access, Cloud NGFW, and Panorama appliances are not affected.
[4:55] Unit 42's Threat Brief walks through the intrusion in detail.
[4:58] Exploitation attempts against the target environment began on April 9th and initially failed.
[5:04] A week later, the attacker landed root, injected shellcode into an NGINX worker process, and used credentials harvested from the firewall's service account to enumerate Active Directory.
[5:16] The most interesting move came on April 29th.
[5:19] The attacker hit the compromised firewall with a SAML authentication flood, which triggered failover in the high availability pair.
[5:27] The standby firewall was promoted to active, inheriting the same internet traffic, and the attacker then exploited that one too.
[5:36] The post-exploitation tooling was open source, and Unit 42 says the overall activity points to a likely state-sponsored cluster, though it has not tied the campaign to a named actor.
[5:47] Palo Alto's advisory was updated May 13th, with fixed builds available for several branches, and additional builds are slated for May 28th.
[5:56] The other major enterprise story is the return of the mini Shai-Hulud worm in NPM and PyPI.
[6:03] On May 11th, TeamPCP published 84 malicious artifacts across 42 TanStack packages in just
[6:11] six minutes, and researchers later documented more than 170 effective packages across projects tied
[6:18] to TanStack, UIPath mistral ai OpenSearch and others now supply chain compromises aren't new
[6:27] and many follow the same familiar pattern but in this case TanStack was using modern supply
[6:33] chain defenses including OIDC Trusted Publishing and SLSA Provenance Attestations but the attacker
[6:41] hijacked the github actions release pipeline itself that meant the malicious packages were
[6:46] published by the real workflow with valid signatures and valid attestations. In other words,
[6:52] provenance proved the package came from the expected pipeline. It did not prove the pipeline
[6:58] was safe. TeamPCP is the same group linked to the Aqua Security Trivy compromise in March
[7:03] and the Bitwarden CLI compromise in April. This is the fourth wave in the broader Shai
[7:09] Hulud campaign. Google's Threat Intelligence group released what may be the most significant
[7:17] AI and security report of the year so far. On May 11th, GTIG published its AI threat tracker,
[7:25] and the headline finding is that for the first time, they've identified a threat actor using
[7:31] a zero-day exploit they believed was developed with the help of an AI model. The vulnerability
[7:36] was a two-factor authentication bypass in an unnamed open source web administration tool.
[7:42] GTIG worked with the vendor to patch it before the group could launch what they were planning
[7:47] as a mass exploitation campaign. Google says it does not believe Gemini was used and there is no
[7:53] public evidence tying the exploit to Anthropic's Mythos. Google's confidence that AI was involved
[7:59] is based on stylistic fingerprints in the exploit code, including a hallucinated CVSS score,
[8:07] textbook Python structure, and educational doc strings of the kind you'd see in training data.
[8:13] John Haltquist, GTIG's chief analyst, summed it up by saying,
[8:18] the race-to-AI-assisted vulnerability discovery isn't imminent, it's already begun.
[8:24] On May 7th, a Linux kernel vulnerability called Dirty Frag became public after its coordinated disclosure embargo collapsed.
[8:31] It began as a chain of two local privilege escalation bugs in Linux kernel networking components,
[8:38] with related vendor advisories now tracking additional variants.
[8:41] It affects many major Linux environments and can allow local unprivileged users to gain root on affected systems.
[8:48] The vulnerability was discovered by researcher Hyunwoo Kim, who goes by v4BEL.
[8:53] He reported both bugs privately to Linux kernel maintainers on April 29th and 30th.
[8:59] On May 7th, an unrelated third party published exploit details for one of the bugs,
[9:05] breaking the embargo before coordinated vendor patches were ready.
[9:09] Per a pre-agreed clause in Kim's disclosure,
[9:11] he was authorized to publish the full Dirty Frag exploit chain immediately, and he did.
[9:17] Microsoft Defender has reported limited in-the-wild exploitation,
[9:20] with attackers using the chain to escalate privileges after gaining SSH access.
[9:26] Dirty Frag is the third bug in a class that includes Dirty Pipe from 2022 and Copy Fail from late April.
[9:33] One operational note worth knowing is that Dirty Frag uses different kernel paths than Copy Fail,
[9:39] so teams should check vendor-specific Dirty Frag guidance rather than assuming prior Copy Fail mitigations are enough.
[9:46] Patches are rolling out across distributions, but timing varies, so check your specific vendor's security advisories.
[9:53] Links to all the stories we covered today are in the description.
[9:56] Thanks for watching (or listening) and we'll see you next week on Wordfence Security News.