Filtered by category: WordFence × Clear
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)
Matched: WordPress
Wordfence reported 319 WordPress vulnerabilities across 222 plugins for the week of September 21–27, 2026. Of these, 305 were patched and 14 remain unpatched. Fourteen vulnerabilities were rated critical, including unauthenticated privilege escalation, remote code execution, and arbitrary file upload flaws. WordPress core itself received a patch for an unauthenticated local file inclusion bug. Cross-site scripting and missing authorization were the most common vulnerability types. 156 researchers contributed disclosures.
Quarterly WordPress Threat Intelligence Report – Q2 2026
Matched: WordPress
Wordfence's Q2 2026 WordPress threat report recorded 2,073 vulnerabilities, down 24% from Q1, but high-threat vulnerabilities rose 15% to 182. The firewall blocked 10.4 billion attacks and 18.2 billion brute-force attempts, while 573,000 sites were found infected, up 21%. Cross-site scripting and missing authorization were the most common vulnerability types. LiteSpeed Cache was the most-targeted plugin. Wordfence disclosed nearly half of all reported vulnerabilities.
Wordfence Bug Bounty Program Monthly Report – June 2026
Matched: WordPress
Wordfence's June 2026 bug bounty report logged 1,066 vulnerability submissions from 306 researchers. Of these, 185 were accepted as in-scope. Total bounties paid reached $42,553, with the top single award of $5,200 going to a researcher who found an authentication bypass in UpdraftPlus affecting 4 million sites. Key findings included remote code execution in Everest Forms Pro, privilege escalation in Kirki, and a supply chain compromise affecting ShapedPlugin plugins.
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026)
Matched: WordPress
Wordfence recorded 358 vulnerabilities across 243 WordPress plugins and 4 themes for the week of September 14–20, 2026. Of these, 311 were patched and 47 remain unpatched. Severity breakdown: 18 critical, 74 high, 262 medium, 4 low. Critical issues included backdoored software in Admin Menu Editor Pro, unauthenticated remote code execution in several plugins, authentication bypasses, and arbitrary file uploads. WordPress Core 7.1 received patches for stored XSS and several authorization flaws. 184 researchers contributed disclosures.
PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core
Matched: WordPress
WordPress released version 7.1.2 on September 22, 2026, patching a critical unauthenticated path traversal vulnerability (CVE-2026-87902) in Core. Security backports were issued for all branches back to 4.7. The flaw lets attackers include arbitrary local PHP files outside the theme directory, potentially enabling remote code execution on sites using themes with a page- subdirectory and accessible PHP files like pearcmd.php. Wordfence Premium users received firewall protection immediately; free users get it October 22.
Inside a Malicious, Stealthy WordPress Must Use Plugin
Matched: WordPress
Wordfence researchers identified sophisticated WordPress malware installed as a must-use plugin, disguised as a health-check tool. It uses custom string obfuscation, hides itself from the dashboard, creates concealed administrator accounts, harvests plaintext passwords, and spreads to other WordPress installations on the same server. Its command channel uses EtherHiding, reading attacker server addresses from Ethereum smart contracts, making takedown difficult. The malware exfiltrates payment credentials, admin sessions, and WooCommerce data, and can remotely update itself, remove plugins, or inject JavaScript. Detection signatures were released June 23, 2026.
100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS
Matched: WordPress
A PHP Object Injection vulnerability (CVE-2026-78175, CVSS 8.8) in the Tutor LMS WordPress plugin affects 100,000+ sites running versions 4.0.7 and earlier. Subscriber-level users can achieve remote code execution by exploiting a serialization length-desync bug caused by misuse of esc_sql(), combined with a GuzzleHttp POP chain. Open registration makes exploitation easy. A patch is available in version 4.0.8, released September 10, 2026.
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 7, 2026 to September 13, 2026)
Matched: WordPress
Wordfence reported 260 WordPress plugin vulnerabilities across 207 plugins for the week of September 7–13, 2026. Of these, 217 were patched, 42 remain unpatched, and one is partially patched. Severity breakdown: 184 medium, 66 high, 10 critical. Top critical issues included unauthenticated remote code execution in The Events Calendar and privilege escalation flaws in several plugins. 147 researchers contributed disclosures.
Boost Engagement with Free Passkeys by Wordfence
Matched: WordPress
Wordfence 9 introduces free passkeys for WordPress and WooCommerce sites, allowing users to sign in with a single click using fingerprint, facial recognition, or a PIN instead of a password. Available in both free and paid versions, passkeys reduce login friction and improve security by eliminating passwords that could be phished. Admins can make passkeys optional or required per user role, and users can register multiple passkeys across devices.
Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability (CVE-2026-27540, CVSS 9.8) in the WooCommerce Wholesale Lead Capture WordPress plugin allows attackers to upload PHP webshells and achieve remote code execution. The flaw exists because file type restrictions rely on attacker-controlled request data. With ~6,000 active installations, Wordfence has blocked over 100,000 exploit attempts. Users should update to version 2.0.3.2 immediately.
Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin
Matched: WordPress
Wordfence discovered two critical unauthenticated remote code execution vulnerability chains in The Events Calendar WordPress plugin, active on over 600,000 sites. Both chains exploit the plugin's widget-rendering pipeline, triggered via pending comment previews without moderator approval, requiring only that comments be enabled on event pages. The first uses PHP Object Injection; the second abuses an arbitrary PHP callable to reset an admin password. Users should update to version 6.17.4.1 immediately.
Wordfence Bug Bounty Program Monthly Report – May 2026
Matched: WordPress
Wordfence's May 2026 bug bounty report recorded 1,095 vulnerability submissions from 293 researchers, down 15% and 10.4% respectively from April. Of those, 149 were in-scope. Total bounties paid reached $34,454, with the highest single award of $6,436 going to a privilege escalation flaw in the Kirki plugin. Critical findings included authentication bypass in Burst Statistics, actively exploited file upload in Breeze Cache, and arbitrary file read in Avada Builder affecting one million sites.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)
Matched: WordPress
Wordfence disclosed 277 WordPress vulnerabilities across 187 plugins and 7 themes for the week of August 31–September 6, 2026. Sixteen were critical (CVSS 9.8), including unauthenticated privilege escalation, remote code execution, and arbitrary file upload flaws in plugins like Hummingbird, JetFormBuilder, Mail Mint, and MemberDash. Most vulnerabilities were patched; 23 remain unpatched. Cross-site scripting and missing authorization were the most common vulnerability types.
Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability (CVE-2026-14894, CVSS 9.8) in the WordPress Super Forms plugin affects versions up to 6.3.313. Attackers can upload PHP webshells and achieve remote code execution using just two HTTP requests. The vendor patched the issue in version 6.3.314 on July 8, 2026. Active exploitation began July 14, with over 250,000 blocked attempts recorded. Users should update immediately and check for unexpected PHP files, particularly Mushr00w_upl.php.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)
Matched: WordPress
Wordfence recorded 246 WordPress vulnerabilities across 174 plugins and 5 themes for the week of August 24–30, 2026. Of these, 234 were patched and 12 remain unpatched. Severity breakdown: 18 critical, 73 high, 153 medium, 2 low. Critical issues included unauthenticated remote code execution in Avada and Drag and Drop Multiple File Upload for CF7, authentication bypasses in ManageWP Worker and WPMU DEV Dashboard, and a backdoor in Newspapers X. Firewall rules were immediately deployed for Premium users covering several high-risk flaws.
Attackers Actively Exploiting Critical Vulnerability in Elementor Pro Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability (CVE-2026-32475, CVSS 9.8) in Elementor Pro affects versions up to 4.2.1. A validation loop flaw allows attackers to bypass file type checks and upload executable PHP files, enabling remote code execution. Exploitation requires a published form with a non-required file upload field. Patch 4.2.2 was released August 19, 2026. Wordfence has blocked over 190,000 exploit attempts since disclosure.
Wordfence Argus Finds Unauthenticated Arbitrary File Upload Vulnerability in Gravity Forms
Matched: WordPress
Wordfence discovered a high-severity arbitrary file upload vulnerability (CVE-2026-19513) in Gravity Forms, a WordPress plugin with over one million installations. Unauthenticated attackers can exploit a cryptographic hash confusion flaw to upload files with attacker-chosen extensions, potentially enabling remote code execution. The flaw was patched in version 3.0.3, released August 20, 2026. Users should update immediately.
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
Matched: WordPress
A critical SQL injection flaw (CVE-2026-19949, CVSS 8.8) was found in the All-in-One WP Migration and Backup WordPress plugin, affecting over 5 million sites. Unauthenticated attackers can plant malicious trackbacks that execute as SQL when an admin performs a backup restore, leaking a secret key and enabling remote code execution. Users should update to version 7.110 immediately. Wordfence Premium users received firewall protection August 16; free users get it September 15.
Wordfence Argus: Moving Beyond Human Research Capability
Matched: WordPress
Wordfence has revealed Argus, an autonomous AI agent built for aggressive WordPress vulnerability hunting. The tool recently discovered major vulnerabilities in popular themes and has more findings in the disclosure pipeline. Argus combines LLMs, prompt engineering, orchestration, and traditional programming. It is model-agnostic, allowing quick pivoting between AI models. Wordfence says Argus already exceeds human research pace and is designed to find critical vulnerabilities before threat actors do.
Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin
Matched: WordPress
A critical authentication bypass (CVE-2026-76581, CVSS 9.8) was found in WPMU DEV Dashboard, a WordPress plugin with ~350,000 installations. When Hub SSO is enabled, unauthenticated attackers can exploit inconsistent HMAC construction across two SSO steps to gain administrator access and potentially execute remote code. The flaw was patched in version 5.0.2, released August 24, 2026. Users unable to update should disable Hub SSO immediately.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 17, 2026 to August 23, 2026)
Matched: WordPress
Wordfence reported 240 WordPress vulnerabilities across 184 plugins and 17 themes for the week of August 17–23, 2026. Of these, 166 were patched and 74 remain unpatched. Seventeen critical-severity flaws were identified, including unauthenticated remote code execution in Broken Link Checker, JetEngine, and WP Compress, and unauthenticated file upload vulnerabilities in Elementor Pro, Forminator Forms, and Masteriyo LMS. Cross-site scripting and missing authorization were the most common vulnerability types. 105 researchers contributed disclosures.
Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales
Matched: WordPress
Wordfence's AI agent Argus discovered a critical unauthenticated remote code execution vulnerability in the Avada WordPress theme and its Fusion Builder plugin, affecting all versions through 7.16 and 3.16 respectively. The exploit chains six weaknesses to allow arbitrary PHP execution without login. Argus found and proved the full chain in roughly two hours. Patches were released August 25, 2026 in Avada 7.16.1 and Fusion Builder 3.16.1.
400,000 WordPress Sites Affected by Account Takeover Vulnerability in TranslatePress WordPress Plugin
Matched: WordPress
A critical vulnerability (CVE-2026-19632, CVSS 9.8) in the TranslatePress WordPress plugin affects over 400,000 sites. Unauthenticated attackers can retrieve an administrator's password reset URL from a secondary-language translation dictionary via a public AJAX endpoint, enabling full account takeover. The flaw only applies when the targeted admin's profile language is set to a published secondary language. Version 3.3.2 patches the issue; users should update immediately.
100,000 WordPress Sites Affected by Privilege Escalation Vulnerability in Pods WordPress Plugin
Matched: WordPress
A critical unauthenticated privilege escalation vulnerability was found in the Pods WordPress plugin, active on over 100,000 sites. Reported August 10, 2026, the flaw lets attackers gain administrator access without credentials, enabling actions like overwriting any user's password, including the site owner's, leading to full site takeover.
Critical Arbitrary File Upload Vulnerability Patched in Elementor Pro WordPress Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability was patched in Elementor Pro, a WordPress plugin with around 6 million active installations. Discovered July 24, 2026, the flaw allows attackers without credentials to upload executable PHP files, potentially enabling remote code execution and complete site takeover. Users should update immediately.