Insights / Threat Intelligence
What we are seeing right now.
The OwlEye SOC processes over 4 billion WordPress-targeted requests per month. A redacted slice of what we are blocking — published weekly.
Severity
CVE
Plugin / Theme
Impact
OwlEye Response
CRITICAL
CVE-2025-4322
Motors Theme (≤ 5.6.67)
Unauthenticated password reset → admin takeover.
Virtually patched at edge WAF within 28 minutes of disclosure; all affected estates force-rotated.
CRITICAL
CVE-2025-32873
OttoKit / SureTriggers (≤ 1.0.78)
Authentication bypass on REST automation endpoints.
Blocked pre-disclosure by generic REST auth-header rule; retroactive audit found zero exposure.
CRITICAL
CVE-2024-10924
Really Simple Security (≤ 9.1.1.1)
Authentication bypass — full admin takeover.
Virtually patched across all OwlEye estates within 41 minutes of disclosure.
HIGH
CVE-2025-6018
GiveWP (≤ 3.16.1)
Unauthenticated PHP object injection via donation form.
Payload signatures deployed; all donation endpoints hardened with allowlist deserialization.
HIGH
CVE-2025-3439
Elementor Pro (≤ 3.25.4)
Stored XSS via template import allowing session hijack.
Sanitizer patch pushed same-day; template imports quarantined pending review.
HIGH
CVE-2024-50550
LiteSpeed Cache (≤ 6.5.0.2)
Privilege escalation via weak hash check.
Mitigated at edge WAF; affected sites force-rotated all session tokens.
HIGH
CVE-2024-44000
LiteSpeed Cache (debug log exposure)
Account takeover via leaked session cookies.
Egress filtering deployed; debug log paths globally blocked.
MEDIUM
CVE-2025-2011
WPForms (≤ 1.9.2.1)
Authenticated CSRF allowing arbitrary form deletion.
Origin & referer policy enforced at proxy layer; no customer impact observed.
MEDIUM
CVE-2024-43917
TI WooCommerce Wishlist
SQL injection in product metadata.
Generic SQLi rule already blocked all observed payloads pre-disclosure.
Showing 9 of 9 entries
Campaigns under active observation.
Operation Balada
Outdated tagDiv themes / Newspaper
Mass injection of malicious JavaScript redirecting visitors to scam pages.
WP-VCD Resurgence
Pirated premium plugins/themes
Backdoor installation, persistent admin user creation, SEO spam.
REST API Enumeration
Unhardened wp-json endpoints
Username enumeration prepping credential stuffing attacks.
SocGholish Fake Update
Compromised sites serving fake browser update lures
Drive-by delivery of remote access trojans to end visitors via injected JS.
XML-RPC Credential Spray
Legacy xmlrpc.php endpoints
High-velocity password spraying using system.multicall to bypass rate limits.
Sign1 Malware Wave
Sites with vulnerable custom HTML widgets
Injection of obfuscated JS redirecting mobile users to VAST ad-fraud networks.