Filtered by category: WordFence, tag: bug bounty × Clear
Wordfence Bug Bounty Program Monthly Report – June 2026
Matched: WordPress
Wordfence's June 2026 bug bounty report logged 1,066 vulnerability submissions from 306 researchers. Of these, 185 were accepted as in-scope. Total bounties paid reached $42,553, with the top single award of $5,200 going to a researcher who found an authentication bypass in UpdraftPlus affecting 4 million sites. Key findings included remote code execution in Everest Forms Pro, privilege escalation in Kirki, and a supply chain compromise affecting ShapedPlugin plugins.
Wordfence Bug Bounty Program Monthly Report – May 2026
Matched: WordPress
Wordfence's May 2026 bug bounty report recorded 1,095 vulnerability submissions from 293 researchers, down 15% and 10.4% respectively from April. Of those, 149 were in-scope. Total bounties paid reached $34,454, with the highest single award of $6,436 going to a privilege escalation flaw in the Kirki plugin. Critical findings included authentication bypass in Burst Statistics, actively exploited file upload in Breeze Cache, and arbitrary file read in Avada Builder affecting one million sites.
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
Matched: WordPress
A critical SQL injection flaw (CVE-2026-19949, CVSS 8.8) was found in the All-in-One WP Migration and Backup WordPress plugin, affecting over 5 million sites. Unauthenticated attackers can plant malicious trackbacks that execute as SQL when an admin performs a backup restore, leaking a secret key and enabling remote code execution. Users should update to version 7.110 immediately. Wordfence Premium users received firewall protection August 16; free users get it September 15.
Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales
Matched: WordPress
Wordfence's AI agent Argus discovered a critical unauthenticated remote code execution vulnerability in the Avada WordPress theme and its Fusion Builder plugin, affecting all versions through 7.16 and 3.16 respectively. The exploit chains six weaknesses to allow arbitrary PHP execution without login. Argus found and proved the full chain in roughly two hours. Patches were released August 25, 2026 in Avada 7.16.1 and Fusion Builder 3.16.1.
400,000 WordPress Sites Affected by Account Takeover Vulnerability in TranslatePress WordPress Plugin
Matched: WordPress
A critical vulnerability (CVE-2026-19632, CVSS 9.8) in the TranslatePress WordPress plugin affects over 400,000 sites. Unauthenticated attackers can retrieve an administrator's password reset URL from a secondary-language translation dictionary via a public AJAX endpoint, enabling full account takeover. The flaw only applies when the targeted admin's profile language is set to a published secondary language. Version 3.3.2 patches the issue; users should update immediately.