Security alerts
What to fix right now.
Short alerts when a serious flaw hits sites like yours: what happened, who is affected, how to check your site and what to do. The important ones from the past year are here too, in case you missed them. Every alert cites its official sources.
Security alerts
October 2025
Post SMTP plugin flaw exploited to take over admin accounts: update to 3.6.1 or later
Post SMTP let anyone read the site's email logs, including password reset emails, and take over an administrator account.