Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)
Matched: WordPress
Wordfence reported 319 WordPress vulnerabilities across 222 plugins for the week of September 21–27, 2026. Of these, 305 were patched and 14 remain unpatched. Fourteen vulnerabilities were rated critical, including unauthenticated privilege escalation, remote code execution, and arbitrary file upload flaws. WordPress core itself received a patch for an unauthenticated local file inclusion bug. Cross-site scripting and missing authorization were the most common vulnerability types. 156 researchers contributed disclosures.
WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory
Matched: WordPress
Researchers have uncovered a WordPress backdoor dubbed "SC" that uses multiple persistence mechanisms — including files, the database, and shared memory — to reinstall itself after removal. Dubbed a "self-healing mesh" by Sucuri, the malware uses the SC_ markers in injected content and is designed to survive cleanup attempts by rebuilding itself through redundant infection vectors.
Vulnerability & Patch Roundup — September 2026
Matched: WordPress
Sucuri's September 2026 vulnerability and patch roundup highlights critical security updates for the WordPress ecosystem. The post warns that most breaches stem from automated attacks exploiting known, previously disclosed vulnerabilities. Site owners are urged to apply available patches promptly, as a single unpatched flaw can cause downtime, reputational damage, or costly remediation.
SC WordPress Malware: A Self-Healing Mesh of Loaders, Drop-Ins, and a Blockchain-Controlled Backdoor
Matched: WordPress
A WordPress malware family dubbed "SC" persists by storing payloads across at least eight locations simultaneously — files, database, and shared memory — with each copy capable of rebuilding the others. This makes simple file deletion ineffective, as the backdoor returns within seconds. Notably, it uses blockchain data to control its backdoor, making command infrastructure difficult to block or take down.
Quarterly WordPress Threat Intelligence Report – Q2 2026
Matched: WordPress
Wordfence's Q2 2026 WordPress threat report recorded 2,073 vulnerabilities, down 24% from Q1, but high-threat vulnerabilities rose 15% to 182. The firewall blocked 10.4 billion attacks and 18.2 billion brute-force attempts, while 573,000 sites were found infected, up 21%. Cross-site scripting and missing authorization were the most common vulnerability types. LiteSpeed Cache was the most-targeted plugin. Wordfence disclosed nearly half of all reported vulnerabilities.
Elementor CSRF Flaw Lets Attackers Take Over Sites After Admin Clicks Crafted Link
Matched: WordPress
A high-severity CSRF flaw in the Elementor WordPress plugin (CVSS 8.8) allows unauthenticated attackers to create rogue admin accounts and take over sites if an administrator clicks a crafted link. No CVE has been assigned yet. Site owners should update the plugin immediately to protect against exploitation.
Wordfence Bug Bounty Program Monthly Report – June 2026
Matched: WordPress
Wordfence's June 2026 bug bounty report logged 1,066 vulnerability submissions from 306 researchers. Of these, 185 were accepted as in-scope. Total bounties paid reached $42,553, with the top single award of $5,200 going to a researcher who found an authentication bypass in UpdraftPlus affecting 4 million sites. Key findings included remote code execution in Everest Forms Pro, privilege escalation in Kirki, and a supply chain compromise affecting ShapedPlugin plugins.
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026)
Matched: WordPress
Wordfence recorded 358 vulnerabilities across 243 WordPress plugins and 4 themes for the week of September 14–20, 2026. Of these, 311 were patched and 47 remain unpatched. Severity breakdown: 18 critical, 74 high, 262 medium, 4 low. Critical issues included backdoored software in Admin Menu Editor Pro, unauthenticated remote code execution in several plugins, authentication bypasses, and arbitrary file uploads. WordPress Core 7.1 received patches for stored XSS and several authorization flaws. 184 researchers contributed disclosures.
Hackers are targeting a critical WordPress flaw, so be on your guard
Matched: WordPress
A critical WordPress flaw (CVE-2026-87902), an unauthenticated path traversal bug scored 8.1, allows PHP file inclusion and potential remote code execution. Exploitation began within hours of a patch release, with attackers now writing malicious PHP files to disk across hundreds of IPs. A fix is available in WordPress 7.1.2, backported to version 4.7. Admins unable to update immediately should block traversal sequences in the pagename parameter and disable register_argc_argv.
Critical WordPress Vulnerability Exploited Immediately After Disclosure
Matched: WordPress
A critical WordPress vulnerability, CVE-2026-87902, is being actively exploited immediately following public disclosure. The path traversal flaw allows remote, unauthenticated attackers to execute arbitrary code on affected systems. Site administrators are urged to apply patches immediately, as the rapid exploitation highlights the risk of delays between vulnerability disclosure and remediation.
Attackers Exploit WordPress CVE-2026-87902 Within Hours of Disclosure
Matched: WordPress
A critical WordPress vulnerability, CVE-2026-87902 (CVSS 9.2), is being actively exploited within hours of disclosure. The flaw allows unauthenticated attackers to achieve remote code execution by manipulating page-template resolution to include arbitrary local PHP files, requiring no authentication to exploit.
PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core
Matched: WordPress
WordPress released version 7.1.2 on September 22, 2026, patching a critical unauthenticated path traversal vulnerability (CVE-2026-87902) in Core. Security backports were issued for all branches back to 4.7. The flaw lets attackers include arbitrary local PHP files outside the theme directory, potentially enabling remote code execution on sites using themes with a page- subdirectory and accessible PHP files like pearcmd.php. Wordfence Premium users received firewall protection immediately; free users get it October 22.
WordPress Issues Patch for Critical Flaw That Can Enable Code Execution on Some Servers
Matched: WordPress
WordPress patched a critical vulnerability in its core software that allows unauthenticated attackers to force a site to load a PHP file from outside its theme folders, potentially enabling remote code execution on some servers. The fix was released September 22 in WordPress 6.7.2 and backported to all supported branches dating to version 4.7. Site owners are urged to update immediately.
Inside a Malicious, Stealthy WordPress Must Use Plugin
Matched: WordPress
Wordfence researchers identified sophisticated WordPress malware installed as a must-use plugin, disguised as a health-check tool. It uses custom string obfuscation, hides itself from the dashboard, creates concealed administrator accounts, harvests plaintext passwords, and spreads to other WordPress installations on the same server. Its command channel uses EtherHiding, reading attacker server addresses from Ethereum smart contracts, making takedown difficult. The malware exfiltrates payment credentials, admin sessions, and WooCommerce data, and can remotely update itself, remove plugins, or inject JavaScript. Detection signatures were released June 23, 2026.
WordPress Patches ‘Click2Shell’ Vulnerability
Matched: WordPress
WordPress has patched a vulnerability dubbed "Click2Shell" that allows attackers to automatically install and preview themes on a target site. The flaw could ultimately lead to remote code execution. WordPress has released a patch and users are advised to update their installations promptly to mitigate potential exploitation risks.
WordPress Comment2Shell Flaw Can Turn Anonymous Comment XSS Into RCE via Admin Session
Matched: WordPress
A WordPress flaw dubbed "Comment2Shell" (CVE-2026-93485) allowed anonymous users to embed malicious scripts in comments. When an admin viewed the page, the script executed server-side code, turning a stored XSS into remote code execution. WordPress patched the issue in version 7.1.1 on September 17 and urged site owners to update immediately.
New WordPress Click2Shell Flaw Forces Theme Installs, Can Chain to Code Execution
Matched: WordPress
installs a theme, but chained with other vulnerabilities it can lead to remote code execution. The flaw affects logged-in administrators who click a malicious link, triggering an unintended theme installation via the WordPress.org directory. WordPress has released patches addressing this and related issues, and users are urged to update immediately.
In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw
Matched: WordPress
A ransomware developer has been sentenced, while a WordPress plugin vulnerability is being actively exploited. Mandiant released its 2026 AI risk report, and a bug bounty hunter was found using PhantomRaven malware. A critical SAP flaw is also drawing attention. An AI-driven attack dubbed Plugin4Shell targets WordPress plugins, and a separate critical SAP vulnerability poses significant enterprise security risks.
100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS
Matched: WordPress
A PHP Object Injection vulnerability (CVE-2026-78175, CVSS 8.8) in the Tutor LMS WordPress plugin affects 100,000+ sites running versions 4.0.7 and earlier. Subscriber-level users can achieve remote code execution by exploiting a serialization length-desync bug caused by misuse of esc_sql(), combined with a GuzzleHttp POP chain. Open registration makes exploitation easy. A patch is available in version 4.0.8, released September 10, 2026.
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 7, 2026 to September 13, 2026)
Matched: WordPress
Wordfence reported 260 WordPress plugin vulnerabilities across 207 plugins for the week of September 7–13, 2026. Of these, 217 were patched, 42 remain unpatched, and one is partially patched. Severity breakdown: 184 medium, 66 high, 10 critical. Top critical issues included unauthenticated remote code execution in The Events Calendar and privilege escalation flaws in several plugins. 147 researchers contributed disclosures.
PHP Webshell Campaign Targets WordPress Through Critical WooCommerce Plugin Bug
Matched: WordPress
Attackers are exploiting a critical vulnerability in a third-party WooCommerce plugin to upload PHP webshells onto WordPress sites, gaining persistent backdoor access. The flaw allows unauthenticated file uploads, enabling remote code execution. Site owners are urged to update the affected plugin immediately and scan for indicators of compromise, including suspicious PHP files in upload directories.
Third-party WooCommerce plugin hits WordPress sites with PHP backdoor abusing recently patched vulnerability
Matched: WordPress
A critical unauthenticated file-upload vulnerability (CVE-2026-27540) in the WooCommerce Wholesale Lead Capture Plugin is being actively exploited to deploy PHP webshells capable of full site takeover. Affecting versions 2.0.3.1 and older, the flaw was patched in February 2026, but Wordfence has blocked over 100,000 attacks across two surge periods. The plugin has around 20,000 active installations. Users should update to v2.0.3.2 immediately and check upload directories for suspicious PHP files.
Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Matched: WordPress
Critical unauthenticated remote code execution vulnerabilities have been discovered in The Events Calendar WordPress plugin, which has over 200,000 active installations. The flaws could allow attackers to fully take over affected sites without needing valid credentials. Site owners are urged to update the plugin immediately to a patched version to mitigate the risk.
Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells
Matched: WordPress
Attackers are exploiting a critical flaw in the WooCommerce Wholesale Lead Capture WordPress plugin, which has over 6,000 active installs. The vulnerability allows unauthenticated attackers to upload arbitrary files, including PHP backdoors, enabling remote code execution. Wordfence has blocked multiple attack attempts targeting the flaw.