Empresa
¿Quiénes somos? Visión y Valores
Herramientas
Email Checker Vigía DNS SSL Checker Password Strength HTTP Headers
Alertas
Todas las alertas Vulnerabilidades Incidentes Solo críticas En CISA KEV
Editorial
Análisis técnico ¿Cuál es mi IP?
Blog
Blog 2MCI ISO 27001 Amenazas LATAM Recursos Gratuitos eBook Gratuito Newsletter Podcast / YouTube
Empresa
Servicios Contacto Suscribirse al Newsletter
🆕 Nuevo en 2MCI
✨ Crear cuenta gratis 🛠️ Ver herramientas sin registro
Ya tengo cuenta
🔒 Iniciar sesión
Equipo
🏠 Portal interno 2MCI
Inicio/Alertas
Seguridad de la Información

Alertas de Seguridad de la Información

Vulnerabilidades explotadas activamente, incidentes y análisis relevantes para México y LATAM. Actualizado automáticamente desde fuentes oficiales.

48 vulnerabilidades en CISA KEV — explotación activa confirmada Ver todas →
Última alerta publicada ahora mismo
Buscando: "WordPress" — 471 resultados ✕ Limpiar búsqueda
13,434
Total alertas
3054
Críticas
10108
Altas
8
Ransomware
1778
Esta semana
RSS
Alta × Limpiar todo ×
M Alto vulnerabilidad
13/08/2026
[CVE-2026-18945] The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its…
The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change the state of arbitrary orders. Exploitation requires WooCommerce to be active and the WP Helper Premium…
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
12/08/2026
[CVE-2026-18789] The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content ex…
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password reset tokens, as well as to persistently change some of its settings.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
12/08/2026
[CVE-2026-18474] The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before u…
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users when a non-default search field type is configured.
nvdaltovulnerabilidad CVSS 8.6 NVD
M Alto vulnerabilidad
12/08/2026
[CVE-2026-18230] The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before u…
The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks an authorization check, allowing any authenticated user such as a Subscriber to perform SQL injection attacks.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
12/08/2026
[CVE-2026-18049] The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce …
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not perform any capability or nonce check on one of its public endpoint actions and builds an option name from a client-supplied value without restricting it to its own options, allowing unauthenticated users to read the value of other autoloaded options whose names end in a matching suffix.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
12/08/2026
[CVE-2026-18057] The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled val…
The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber account and above to perform SQL injection attacks and tamper with booking consent records belonging to other people.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
12/08/2026
[CVE-2026-18048] The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled val…
The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not validate a client-controlled value used to build a file path in one of its public endpoint actions, and performs no authorisation check on it, allowing unauthenticated attackers to delete arbitrary ZIP archives on the server, including ones stored outside the web root.
nvdaltovulnerabilidad CVSS 7.5 NVD

📬 Alertas semanales SI directo en tu email

Las vulnerabilidades más críticas para LATAM, con contexto y recomendaciones accionables. Gratis.

Suscribirme →
M Alto vulnerabilidad
12/08/2026
[CVE-2026-16977] The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-contr…
The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database-backed choice field, allowing subscriber-level users to perform second-order SQL injection.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
12/08/2026
[CVE-2026-16253] The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authori…
The Total Upkeep WordPress plugin before 1.17.3 does not adequately protect the secret that authorizes its backup-restore functionality and exposes it to unauthenticated users, allowing them to disclose sensitive backup information and to force a full site restore that overwrites the live site's files and database.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
12/08/2026
[CVE-2026-16294] The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of…
The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.17.1 does not validate one of its Podcast Episode URL settings before performing a server-side request with it, allowing users with a role as low as Contributor to perform Server-Side Request Forgery attacks that can target internal services.
nvdaltovulnerabilidad CVSS 7.1 NVD
M Alto vulnerabilidad
12/08/2026
[CVE-2026-14925] The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of it…
The Import WP WordPress plugin before 2.14.23 does not perform any authorization check on one of its export-file download handlers, allowing unauthenticated attackers to download export files generated by administrators, which may contain user personal data such as email addresses, login names and roles. Exploitation requires an unconsumed export to already exist and a low-entropy, time-based dow…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
12/08/2026
[CVE-2026-13613] The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied para…
The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
12/08/2026
[CVE-2026-13171] The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-l…
The Eventin WordPress plugin before 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.
nvdaltovulnerabilidad CVSS 8.2 NVD
M Alto vulnerabilidad
12/08/2026
Vulnerabilidad alta de autenticación en plugin WordPress Passwordless Login de VentraConnect
El plugin 'Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login' para WordPress (versiones hasta 1.4.3) contiene un fallo de autenticación que permite eludir el acceso mediante verificación insuficiente del correo electrónico devuelto por Spotify. Un atacante podría acceder a cuentas sin credenciales válidas. Afecta directamente a sitios WordPress en México y LATAM que implementen este plugin con autenticación social.
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
11/08/2026
[CVE-2026-15606] The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all v…
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level and above permissions, to reset the password of any user on the site, including administrat…
nvdaltovulnerabilidad CVSS 8.8 NVD

🛡 ¿Estás expuesto a alguna de estas vulnerabilidades?

Evaluación gratuita inicial con el equipo 2MCI: identifica exposición y plan de remediación.

Habla con un experto →
M Alto vulnerabilidad
11/08/2026
[CVE-2026-19091] The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPre…
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_revision function in all versions up to, and including, 2.8.169. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary files on the server, whi…
nvdaltovulnerabilidad CVSS 8.1 NVD
M Alto vulnerabilidad
11/08/2026
[CVE-2026-13457] The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Co…
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing th…
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
11/08/2026
[CVE-2026-15426] The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugi…
The AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.11.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to overwri…
nvdaltovulnerabilidad CVSS 8.8 NVD
M Alto vulnerabilidad
10/08/2026
[CVE-2026-18470] The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset requ…
The Login & Register Forms WordPress plugin before 4.0.2 does not verify that a password reset request comes from the account's owner, and does not adequately redact the address returned in its response, allowing unauthenticated users to obtain registered users' email addresses, including administrators'.
nvdaltovulnerabilidad CVSS 7.5 NVD
M Alto vulnerabilidad
10/08/2026
[CVE-2026-18946] The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copyin…
The Contact Form to Any API WordPress plugin before 3.0.7 does not use a random filename when copying files uploaded through contact forms into a publicly accessible directory, allowing unauthenticated attackers to enumerate and download files submitted by other users.
nvdaltovulnerabilidad CVSS 7.5 NVD