Filtered by category: WordFence × Clear
600,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in Forminator Forms WordPress Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability was discovered in the Forminator Forms WordPress plugin, affecting over 600,000 active installations. The flaw, reported to Wordfence on July 14, 2026, allows attackers to upload files without authentication, posing significant security risks to affected sites. Users are advised to update the plugin promptly.
40,000 WordPress Sites affected by Authentication Bypass Vulnerability in User Profile Builder WordPress Plugin
Matched: WordPress
A critical authentication bypass vulnerability was found in the User Profile Builder WordPress plugin, affecting over 40,000 sites. Reported July 14, 2026, the flaw allows unauthenticated attackers to log in as the primary administrator (user ID 1), enabling full site takeover. The vulnerability is only exploitable when the plugin's "Automatically Log In" setting is enabled.
PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response
Matched: WordPress
A supply chain compromise was discovered in the BdThemes WordPress plugin ecosystem, reported to Wordfence on August 7, 2026. The attack involved a poisoned API response affecting multiple plugins from the vendor. All affected plugins have been temporarily closed in the official WordPress plugins directory while the WordPress Plugins team conducts a full inspection and ongoing investigation.