A critical WordPress plugin flaw allows threat actors to run arbitrary PHP commands, potentially taking over entire websites.
A map exploit, where players could reach unintended areas of the map, has been fixed.