The agency’s Computer Emergency Readiness and Response Team (NITDA-CERRT) issued the advisory on Wednesday, describing the flaw, tracked as CVE-2026-64638, as a pre-authentication cross-site scripting (XSS) vulnerability affecting the WordPress login page.

According to NITDA-CERRT, the vulnerability can be exploited without valid user credentials, making it particularly dangerous for website owners.

“A new pre-authentication cross-site scripting (XSS) vulnerability has been discovered on the WordPress login screen, which could potentially lead to PHP code execution,” the advisory stated.

The agency warned that successful exploitation could enable attackers to steal data, escalate privileges, install backdoors, inject malware or completely compromise affected systems.

“The vulnerability can be exploited without authentication or prior privileges. Immediate action is recommended to mitigate this threat,” NITDA-CERRT said.

It added that the pre-authentication nature of the flaw significantly increases the risk because attackers do not require authorised access before launching an attack.

To mitigate the threat, NITDA urged administrators to upgrade WordPress Core to version 7.0.3.

The agency also recommended deploying a Web Application Firewall (WAF), installing reputable WordPress security plugins, restricting access to sensitive administrative areas through strong authentication controls and maintaining regular website backups to minimise the impact of any successful attack.

The post NITDA Warns WordPress Users to Patch Critical Security Flaw appeared first on Tech Digest News.

The vulnerability was identified following a change in ownership of plug-in developer Essential Plugin, according to cybersecurity researchers. The backdoor, reportedly inserted into the plug-ins’ source code after the acquisition, remained dormant before activating earlier this month.

Once triggered, the malicious code was pushed to websites running the compromised plug-ins, potentially exposing thousands of installations to security risks. Essential Plugin claims to have served over 400,000 installations, while WordPress data indicates tens of thousands of active deployments.

Security experts have warned that plug-ins, which require deep access to website systems, can become attack vectors if compromised. The incident highlights risks associated with supply chain attacks, particularly when software ownership changes without user awareness.

The affected plug-ins have since been removed from the WordPress directory. Website administrators are being advised to review their installations and remove any compromised extensions to prevent further exposure.

The post Malicious Backdoor Discovered in Popular WordPress Plug-ins appeared first on Tech Digest News.

The National Information Technology Development Agency (NITDA) has issued a warning to website owners about a critical security flaw in the Jupiter X Core plugin for WordPress, which could allow hackers to take full control of affected websites.

In a statement released on Wednesday, the agency’s Computer Emergency Readiness and Response Team (CERRT) identified the vulnerability as CVE-2025-0366, describing it as an unauthenticated privilege escalation flaw. If exploited, attackers could execute arbitrary code, gain administrative access without authentication, modify website content, inject malware, or completely deface websites—posing a serious threat to platforms handling sensitive user data.

Website owners using the affected plugin are advised to update immediately to the latest patched version 4.8.8 and remove unused or outdated plugins.

NITDA further urged website administrators to monitor for unauthorized admin accounts, track unexpected website changes, and implement strong authentication methods to enhance security.

The post NITDA Issues Warning Over WordPress Plugin Vulnerability appeared first on Tech Digest News.

TECH DIGEST- In a groundbreaking move, WordPress, an online stalwart with over twenty years of history, has introduced an innovative strategy to ensure the endurance of digital legacies for generations to come.

The newly revealed “100-Year Plan” offers individuals, families, and companies the opportunity to secure domain registrations for an unprecedented century-long period. This visionary initiative redefines the concept of longevity in the digital realm, revolutionizing how online assets are perceived and protected.

READ ALSO: OpenAI Introduces ChatGPT Enterprise

Tailored to cater to a diverse range of needs, the “100-Year Plan” addresses the aspirations of families eager to preserve cherished memories, entrepreneurs documenting their ventures, and individuals navigating the uncertainties of evolving technology. At the heart of this plan lies a commitment to future-proof the digital landscape by providing a comprehensive set of offerings:

1. Century-Long Domain Registration: Unlike the standard decade-long domain registration, this plan extends the registration period to a remarkable century. Recognizing the significance of domains as invaluable digital assets, WordPress aims to safeguard these virtual spaces for the benefit of future generations.
2. Comprehensive Backup and Preservation: As custodians of digital legacies, WordPress will maintain multiple backups across geographically dispersed data centers. Notably, public sites will be automatically archived in the Internet Archive, ensuring the enduring availability of content across time.
3. Advanced Ownership Protocols: WordPress simplifies life’s transitions with enhanced ownership assistance. Whether transferring website ownership or gifting a digital presence to a newborn, the platform commits to providing support at every step of the process.
4. Premium Managed Hosting: The plan encompasses unparalleled managed WordPress hosting, featuring exceptional speed, unlimited bandwidth, and robust security measures within an all-inclusive package.
5. 24/7 Premier Support: The “100-Year Plan” guarantees personalized support from the moment of interest, ensuring comprehensive assistance throughout the digital journey.

While the allure of safeguarding digital assets for an entire century is compelling, the plan comes with a notable price tag. Interested parties must make a substantial one-time payment of $38,000, reflecting the extraordinary nature of the offering. As the digital landscape continues to evolve, questions about WordPress’s strategies for maintaining domain relevance and backups over a century arise. While the future remains uncertain, WordPress CEO Matt Mullenweg views this plan as a catalyst for fostering long-term thinking in both individuals and companies. As an organization known for embracing innovative products and features, such as AI writing assistants and paid newsletters, the “100-Year Plan” underscores WordPress’s commitment to constant innovation and adaptation in a rapidly changing technological landscape.

The post WordPress Unveils 100-Year Plan’ to Preserve Online Legacies appeared first on Tech Digest News.