Filtered by category: WordFence, tag: patch management × Clear
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)
Matched: WordPress
Wordfence reported 319 WordPress vulnerabilities across 222 plugins for the week of September 21–27, 2026. Of these, 305 were patched and 14 remain unpatched. Fourteen vulnerabilities were rated critical, including unauthenticated privilege escalation, remote code execution, and arbitrary file upload flaws. WordPress core itself received a patch for an unauthenticated local file inclusion bug. Cross-site scripting and missing authorization were the most common vulnerability types. 156 researchers contributed disclosures.
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026)
Matched: WordPress
Wordfence recorded 358 vulnerabilities across 243 WordPress plugins and 4 themes for the week of September 14–20, 2026. Of these, 311 were patched and 47 remain unpatched. Severity breakdown: 18 critical, 74 high, 262 medium, 4 low. Critical issues included backdoored software in Admin Menu Editor Pro, unauthenticated remote code execution in several plugins, authentication bypasses, and arbitrary file uploads. WordPress Core 7.1 received patches for stored XSS and several authorization flaws. 184 researchers contributed disclosures.
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 7, 2026 to September 13, 2026)
Matched: WordPress
Wordfence reported 260 WordPress plugin vulnerabilities across 207 plugins for the week of September 7–13, 2026. Of these, 217 were patched, 42 remain unpatched, and one is partially patched. Severity breakdown: 184 medium, 66 high, 10 critical. Top critical issues included unauthenticated remote code execution in The Events Calendar and privilege escalation flaws in several plugins. 147 researchers contributed disclosures.
Wordfence Bug Bounty Program Monthly Report – May 2026
Matched: WordPress
Wordfence's May 2026 bug bounty report recorded 1,095 vulnerability submissions from 293 researchers, down 15% and 10.4% respectively from April. Of those, 149 were in-scope. Total bounties paid reached $34,454, with the highest single award of $6,436 going to a privilege escalation flaw in the Kirki plugin. Critical findings included authentication bypass in Burst Statistics, actively exploited file upload in Breeze Cache, and arbitrary file read in Avada Builder affecting one million sites.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)
Matched: WordPress
Wordfence disclosed 277 WordPress vulnerabilities across 187 plugins and 7 themes for the week of August 31–September 6, 2026. Sixteen were critical (CVSS 9.8), including unauthenticated privilege escalation, remote code execution, and arbitrary file upload flaws in plugins like Hummingbird, JetFormBuilder, Mail Mint, and MemberDash. Most vulnerabilities were patched; 23 remain unpatched. Cross-site scripting and missing authorization were the most common vulnerability types.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)
Matched: WordPress
Wordfence recorded 246 WordPress vulnerabilities across 174 plugins and 5 themes for the week of August 24–30, 2026. Of these, 234 were patched and 12 remain unpatched. Severity breakdown: 18 critical, 73 high, 153 medium, 2 low. Critical issues included unauthenticated remote code execution in Avada and Drag and Drop Multiple File Upload for CF7, authentication bypasses in ManageWP Worker and WPMU DEV Dashboard, and a backdoor in Newspapers X. Firewall rules were immediately deployed for Premium users covering several high-risk flaws.