Filtered by category: WordFence, tag: authentication bypass × Clear
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 7, 2026 to September 13, 2026)
Matched: WordPress
Wordfence reported 260 WordPress plugin vulnerabilities across 207 plugins for the week of September 7–13, 2026. Of these, 217 were patched, 42 remain unpatched, and one is partially patched. Severity breakdown: 184 medium, 66 high, 10 critical. Top critical issues included unauthenticated remote code execution in The Events Calendar and privilege escalation flaws in several plugins. 147 researchers contributed disclosures.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)
Matched: WordPress
Wordfence recorded 246 WordPress vulnerabilities across 174 plugins and 5 themes for the week of August 24–30, 2026. Of these, 234 were patched and 12 remain unpatched. Severity breakdown: 18 critical, 73 high, 153 medium, 2 low. Critical issues included unauthenticated remote code execution in Avada and Drag and Drop Multiple File Upload for CF7, authentication bypasses in ManageWP Worker and WPMU DEV Dashboard, and a backdoor in Newspapers X. Firewall rules were immediately deployed for Premium users covering several high-risk flaws.
Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin
Matched: WordPress
A critical authentication bypass (CVE-2026-76581, CVSS 9.8) was found in WPMU DEV Dashboard, a WordPress plugin with ~350,000 installations. When Hub SSO is enabled, unauthenticated attackers can exploit inconsistent HMAC construction across two SSO steps to gain administrator access and potentially execute remote code. The flaw was patched in version 5.0.2, released August 24, 2026. Users unable to update should disable Hub SSO immediately.
40,000 WordPress Sites affected by Authentication Bypass Vulnerability in User Profile Builder WordPress Plugin
Matched: WordPress
A critical authentication bypass vulnerability was found in the User Profile Builder WordPress plugin, affecting over 40,000 sites. Reported July 14, 2026, the flaw allows unauthenticated attackers to log in as the primary administrator (user ID 1), enabling full site takeover. The vulnerability is only exploitable when the plugin's "Automatically Log In" setting is enabled.