CVE-2016-10960: Joomlaserviceprovider Wsecure

High severity, CVSS 8.8. EPSS: 9% chance of exploitation in the next 30 days.

The wsecure plugin before 2.4 for WordPress has remote code execution via shell metacharacters in the wsecure-config.php publish parameter.

Affected products

• Joomlaserviceprovider Wsecure: before 2.4 (fixed in 2.4)

Published 2019-09-16. Last modified 2026-06-17.