Filtered by category: WordFence, tag: vulnerabilities × Clear
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 7, 2026 to September 13, 2026)
Matched: WordPress
Wordfence reported 260 WordPress plugin vulnerabilities across 207 plugins for the week of September 7–13, 2026. Of these, 217 were patched, 42 remain unpatched, and one is partially patched. Severity breakdown: 184 medium, 66 high, 10 critical. Top critical issues included unauthenticated remote code execution in The Events Calendar and privilege escalation flaws in several plugins. 147 researchers contributed disclosures.
600,000 WordPress Sites Affected by Arbitrary File Upload Vulnerability in Forminator Forms WordPress Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability was discovered in the Forminator Forms WordPress plugin, affecting over 600,000 active installations. The flaw, reported to Wordfence on July 14, 2026, allows attackers to upload files without authentication, posing significant security risks to affected sites. Users are advised to update the plugin promptly.