WordPress Vulnerabilities – February 1st to February 15th, 2026
Introduction: Keeping your WordPress site secure is essential. In this post, you’ll find a summary of the latest plugin vulnerabilities discovered over the first half of February.
WPvivid Backup & Migration
Summary: Critical Remote Code Execution (RCE) via improper RSA decryption.
Affected Versions: <= 0.9.123
Source: View details
Activity Log for WordPress
Summary: Missing authorization check allowing sensitive log access.
Affected Versions: <= 1.2.8
Source: View details
Truelysell Core
Summary: Unauthenticated privilege escalation via registration.
Affected Versions: <= 1.8.7
Source: View details
Midi-Synth
Summary: Unauthenticated arbitrary file upload in AJAX export action.
Affected Versions: <= 1.1.0
Source: View details
Conclusion: Update your plugins and stay informed!