Spam emails about WordPress vulnerabilities
Fake emails about "high-risk vulnerabilities" in WordPress contain links that you should not click. As always, caution is your best defence against phishing attacks.
Today a customer did the right thing and forwarded a strange email to us to check whether it was genuine. It was not, and thanks to their they avoided an attempted phishing attack.
The email was made to look as if it was sent by WordPress, saying that a security risk (an so-called "Remote Code Execution (RCE) high-risk vulnerability") required a new patch, CVE-2024-41688. The "Download" link leads to a fake website which harvests user information.
If you have received an email with these details, ignore it and block the sender:
Sender: [email protected] or [email protected]
Subject: CRITICAL: Your website <example.com> is at risk!
Recommended WordPress patch: CVE-2024-46188 (which is a fake code - this patch does not exist)
More about WordPress impersonation scams
There have been a number of similar spam emails sent to WordPress users. WordPress's own security team has published an article about them. For more information and advice, see Alert: WordPress Security Team Impersonation Scams.
Hosting and Domains
Welcome to MyHost
WordPress Hosting
From $8.95/mo
Domains
From $25.95/yr
Email Hosting
From $4.95/mo
Managed Services
From $200/mo
Expert Advice
If you have any questions about running WordPress securely and quickly, get in touch.
Contact usReal words from real MyHost customers
Awesome service. Answered every question super fast. Guided me through the process and followed up consistently to make sure everything was OK. Just awesome service. Couldn't be happier. ★★★★★
Great price, they're very helpful and easy to deal with. ★★★★★
Quick response to call, friendly manner, superb understanding and technical knowhow. Problem quickly resolved. ★★★★★