Boost Engagement with Free Passkeys by Wordfence
Matched: WordPress
Wordfence 9 introduces free passkeys for WordPress and WooCommerce sites, allowing users to sign in with a single click using fingerprint, facial recognition, or a PIN instead of a password. Available in both free and paid versions, passkeys reduce login friction and improve security by eliminating passwords that could be phished. Admins can make passkeys optional or required per user role, and users can register multiple passkeys across devices.
Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability (CVE-2026-27540, CVSS 9.8) in the WooCommerce Wholesale Lead Capture WordPress plugin allows attackers to upload PHP webshells and achieve remote code execution. The flaw exists because file type restrictions rely on attacker-controlled request data. With ~6,000 active installations, Wordfence has blocked over 100,000 exploit attempts. Users should update to version 2.0.3.2 immediately.
Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin
Matched: WordPress
Wordfence discovered two critical unauthenticated remote code execution vulnerability chains in The Events Calendar WordPress plugin, active on over 600,000 sites. Both chains exploit the plugin's widget-rendering pipeline, triggered via pending comment previews without moderator approval, requiring only that comments be enabled on event pages. The first uses PHP Object Injection; the second abuses an arbitrary PHP callable to reset an admin password. Users should update to version 6.17.4.1 immediately.
WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution
Matched: WordPress
WordPress has introduced automated security scanning for all plugin updates before distribution via WordPress.org. While new plugins already undergo review before entering the directory, updates previously shipped without similar checks. The system will analyze each release for potential security issues and block high-risk updates before they reach users, closing a long-standing gap in the platform's plugin security process.
Wordfence Bug Bounty Program Monthly Report – May 2026
Matched: WordPress
Wordfence's May 2026 bug bounty report recorded 1,095 vulnerability submissions from 293 researchers, down 15% and 10.4% respectively from April. Of those, 149 were in-scope. Total bounties paid reached $34,454, with the highest single award of $6,436 going to a privilege escalation flaw in the Kirki plugin. Critical findings included authentication bypass in Burst Statistics, actively exploited file upload in Breeze Cache, and arbitrary file read in Avada Builder affecting one million sites.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)
Matched: WordPress
Wordfence disclosed 277 WordPress vulnerabilities across 187 plugins and 7 themes for the week of August 31–September 6, 2026. Sixteen were critical (CVSS 9.8), including unauthenticated privilege escalation, remote code execution, and arbitrary file upload flaws in plugins like Hummingbird, JetFormBuilder, Mail Mint, and MemberDash. Most vulnerabilities were patched; 23 remain unpatched. Cross-site scripting and missing authorization were the most common vulnerability types.
Two major security flaws are affecting more than six million WordPress websites
Matched: WordPress
Wordfence has disclosed two critical vulnerabilities in popular WordPress plugins Elementor Pro and Super Forms, putting over six million websites at risk. Both flaws allow unauthenticated attackers to upload executable files, enabling remote code execution. Tracked as CVE-2026-32475 and CVE-2026-14894, each carries a 9.8/10 severity score. Both have been patched, but exploitation attempts have already exceeded 440,000 combined. Users are urged to update immediately.
Elementor Pro WordPress Plugin Vulnerability Exploited to Hack Sites
Matched: WordPress
A critical vulnerability in the Elementor Pro WordPress plugin, CVE-2026-32475, is being actively exploited. Scoring 9.8 on the CVSS scale, the flaw is an arbitrary file upload bug in the plugin's form submission handler, allowing attackers to upload malicious files and potentially take full control of affected websites. Site owners are urged to update immediately.
WordPress Security Plugins: How to Choose the Right One
Matched: WordPress
WordPress security plugins help protect sites by scanning for malware, monitoring file changes, and blocking suspicious activity. Most sites should use one alongside a firewall that filters traffic before WordPress loads. Key features to look for include layered protection, strong detection, false alarm handling, low performance impact, and reliable human support.
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
Matched: WordPress
Over 440,000 exploit attempts have targeted two critical WordPress plugin vulnerabilities: CVE-2026-14894 in Super Forms, allowing unauthenticated attackers to upload arbitrary files, and a flaw in Elementor Pro. Both carry high severity ratings. Wordfence detected the attacks, warning site owners to update affected plugins immediately to prevent potential remote code execution and full site compromise.
Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability (CVE-2026-14894, CVSS 9.8) in the WordPress Super Forms plugin affects versions up to 6.3.313. Attackers can upload PHP webshells and achieve remote code execution using just two HTTP requests. The vendor patched the issue in version 6.3.314 on July 8, 2026. Active exploitation began July 14, with over 250,000 blocked attempts recorded. Users should update immediately and check for unexpected PHP files, particularly Mushr00w_upl.php.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)
Matched: WordPress
Wordfence recorded 246 WordPress vulnerabilities across 174 plugins and 5 themes for the week of August 24–30, 2026. Of these, 234 were patched and 12 remain unpatched. Severity breakdown: 18 critical, 73 high, 153 medium, 2 low. Critical issues included unauthenticated remote code execution in Avada and Drag and Drop Multiple File Upload for CF7, authentication bypasses in ManageWP Worker and WPMU DEV Dashboard, and a backdoor in Newspapers X. Firewall rules were immediately deployed for Premium users covering several high-risk flaws.
Over 3 Million WordPress Sites Affected by Migration Plugin Vulnerability
Matched: WordPress
A high-severity SQL injection vulnerability, CVE-2026-19949, has been discovered in a WordPress migration plugin used by over 3 million sites. The flaw could allow unauthenticated attackers to execute remote code. Site administrators are urged to update the affected plugin promptly to mitigate potential exploitation.
Attackers Actively Exploiting Critical Vulnerability in Elementor Pro Plugin
Matched: WordPress
A critical unauthenticated arbitrary file upload vulnerability (CVE-2026-32475, CVSS 9.8) in Elementor Pro affects versions up to 4.2.1. A validation loop flaw allows attackers to bypass file type checks and upload executable PHP files, enabling remote code execution. Exploitation requires a published form with a non-required file upload field. Patch 4.2.2 was released August 19, 2026. Wordfence has blocked over 190,000 exploit attempts since disclosure.
Wordfence Argus Finds Unauthenticated Arbitrary File Upload Vulnerability in Gravity Forms
Matched: WordPress
Wordfence discovered a high-severity arbitrary file upload vulnerability (CVE-2026-19513) in Gravity Forms, a WordPress plugin with over one million installations. Unauthenticated attackers can exploit a cryptographic hash confusion flaw to upload files with attacker-chosen extensions, potentially enabling remote code execution. The flaw was patched in version 3.0.3, released August 20, 2026. Users should update immediately.
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
Matched: WordPress
A critical SQL injection flaw (CVE-2026-19949, CVSS 8.8) was found in the All-in-One WP Migration and Backup WordPress plugin, affecting over 5 million sites. Unauthenticated attackers can plant malicious trackbacks that execute as SQL when an admin performs a backup restore, leaking a secret key and enabling remote code execution. Users should update to version 7.110 immediately. Wordfence Premium users received firewall protection August 16; free users get it September 15.
Vulnerability & Patch Roundup — August 2026
Matched: WordPress
Security researchers have compiled August 2026's key vulnerability patches for the WordPress ecosystem. Most breaches stem from automated attacks exploiting previously disclosed, known vulnerabilities. Unpatched flaws can take sites offline, damage reputations, or require costly remediation. The monthly roundup aims to help site owners maintain their security posture by staying current on critical updates.
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Matched: WordPress
Five critical flaws in WordPress plugins and themes — WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP — could allow attackers to bypass authentication, take over accounts, or execute arbitrary code. Reported by Wordfence and Patchstack, the vulnerabilities carry CVSS scores as high as 9.8. Site owners are urged to update affected components immediately.
Wordfence Argus: Moving Beyond Human Research Capability
Matched: WordPress
Wordfence has revealed Argus, an autonomous AI agent built for aggressive WordPress vulnerability hunting. The tool recently discovered major vulnerabilities in popular themes and has more findings in the disclosure pipeline. Argus combines LLMs, prompt engineering, orchestration, and traditional programming. It is model-agnostic, allowing quick pivoting between AI models. Wordfence says Argus already exceeds human research pace and is designed to find critical vulnerabilities before threat actors do.
Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin
Matched: WordPress
A critical authentication bypass (CVE-2026-76581, CVSS 9.8) was found in WPMU DEV Dashboard, a WordPress plugin with ~350,000 installations. When Hub SSO is enabled, unauthenticated attackers can exploit inconsistent HMAC construction across two SSO steps to gain administrator access and potentially execute remote code. The flaw was patched in version 5.0.2, released August 24, 2026. Users unable to update should disable Hub SSO immediately.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 17, 2026 to August 23, 2026)
Matched: WordPress
Wordfence reported 240 WordPress vulnerabilities across 184 plugins and 17 themes for the week of August 17–23, 2026. Of these, 166 were patched and 74 remain unpatched. Seventeen critical-severity flaws were identified, including unauthenticated remote code execution in Broken Link Checker, JetEngine, and WP Compress, and unauthenticated file upload vulnerabilities in Elementor Pro, Forminator Forms, and Masteriyo LMS. Cross-site scripting and missing authorization were the most common vulnerability types. 105 researchers contributed disclosures.
Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales
Matched: WordPress
Wordfence's AI agent Argus discovered a critical unauthenticated remote code execution vulnerability in the Avada WordPress theme and its Fusion Builder plugin, affecting all versions through 7.16 and 3.16 respectively. The exploit chains six weaknesses to allow arbitrary PHP execution without login. Argus found and proved the full chain in roughly two hours. Patches were released August 25, 2026 in Avada 7.16.1 and Fusion Builder 3.16.1.
400,000 WordPress Sites Affected by Account Takeover Vulnerability in TranslatePress WordPress Plugin
Matched: WordPress
A critical vulnerability (CVE-2026-19632, CVSS 9.8) in the TranslatePress WordPress plugin affects over 400,000 sites. Unauthenticated attackers can retrieve an administrator's password reset URL from a secondary-language translation dictionary via a public AJAX endpoint, enabling full account takeover. The flaw only applies when the targeted admin's profile language is set to a published secondary language. Version 3.3.2 patches the issue; users should update immediately.
Attackers Target miniOrange SAML Flaws That Can Grant WordPress Admin Access
Matched: WordPress
Attackers are exploiting two critical authentication bypass flaws in the miniOrange SAML 2.0 Single Sign On WordPress plugin. The vulnerabilities, tracked as CVE-2026-61979 and assigned a CVSS score of 8.1, allow unauthenticated attackers to log in as any WordPress user, including administrators. The flaws were disclosed by Patchstack, and active exploitation attempts have already been observed.
Experts warn 2,000 hacked WordPress sites were secretly running a global crime ring
Matched: WordPress
Security researchers have discovered around 2,000 compromised WordPress sites being used as infrastructure for a global cybercrime operation. The hacked sites served multiple roles: delivering malware to victims, acting as command-and-control servers for infected devices, and storing stolen data. The operation exploited the sites' legitimate reputations to avoid detection.