News
02.11.2026
2
Shield now checks 7 more dangerous plugins and exposed debug panels
This week we tracked new vulnerabilities that let attackers into a site without a password, and some are already used in attacks.
This week we tracked new vulnerabilities that let attackers into a site without a password, and some are already used in attacks. All of them are now part of the free Shield scan:
- WordPress plugins: 10Web Booster, Bricksforge, Kirki, WP Maps Pro, LatePoint, WordPress File Upload. They can let an attacker upload a malicious file, create an admin account or take over someone else's account.
- Balbooa Forms for Joomla: file upload and code execution, listed in CISA KEV.
- Exposed Laravel Ignition, Laravel Telescope and Symfony Profiler debug panels. If someone forgot to turn them off, any visitor can see passwords, keys and user data.
- Node.js sites: Node.js has shipped a fix for a vulnerability already used in attacks. Shield tells you what to check.
For every finding, Shield explains the risk and what to do. If a developer runs your site, just forward them the report.
