WordPress security
Articles tagged WordPress security.
php2shell in the Wild: What Attackers Tried in the First 14 Hours, and What Stopped Them
Attacks on php2shell reached InstaWP-hosted sites 2h20m after disclosure. None succeeded. What each campaign tried, and which PHP setting stopped it.
PHP Security Vulnerabilities CVE-2026-109618 and CVE-2026-109619 (php2shell): What InstaWP Customers Need to Know
Live updates on the php2shell PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619): what InstaWP has done, and what you need to do based on your site's PHP version.
WPVibe Review (2026): What It Does, Pricing and Risks
InstaWP installed WPVibe 1.20.4 and read its code. What WPVibe does, how its cloud relay and signed approvals work, pricing from 100 free calls a day…
Is MCP WordPress Integration Safe and Secure? What InstaMCP Locks Down
Yes, if you limit what the AI agent can do. InstaWP tested InstaMCP 1.11.4 on a throwaway sandbox: role-scoped tokens, Safe Mode, power tools off by…
Novamira Review 2026: Features, Pricing, Pros, Cons and the Best Alternative
Our hands-on Novamira review: what the Novamira WordPress MCP plugin does, how to install it, pricing, its security model in its own words, how it compares…
WordPress Virtual Patching: How We Block a Plugin Exploit Before You Can Update
Virtual patching blocks a WordPress exploit at the web server, before PHP runs, so a site is protected while it still runs the unpatched plugin. How…
WordPress Plugin Security Best Practices Now That WordPress.org Scans Every Release
WordPress.org now reviews every plugin and theme release before distributing it, and blocks high-risk releases. Here is exactly what that check covers, the four gaps it…
Elementor Pro Critical RCE (CVE-2026-32475): What It Means and What We Did
A critical unauthenticated file upload to RCE flaw in Elementor Pro, affecting every version up to 4.2.1. What the bug actually is, who is really at…
Inside Our wp2shell Response: How We Protected the Fleet From a WordPress Core RCE (CVE-2026-63030)
The full engineering story of how InstaWP detected, blocked and verified protection against wp2shell (CVE-2026-63030), a pre-auth WordPress core RCE, fleet-wide and within hours.
The Most Practical WordPress Performance and Security Guide
Speed and security issues often go unnoticed (until it’s too late). For starters, a site that takes more than 3 seconds to load can lose up…