Filtered by tag: patch management × Clear
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)
Matched: WordPress
Wordfence reported 319 WordPress vulnerabilities across 222 plugins for the week of September 21–27, 2026. Of these, 305 were patched and 14 remain unpatched. Fourteen vulnerabilities were rated critical, including unauthenticated privilege escalation, remote code execution, and arbitrary file upload flaws. WordPress core itself received a patch for an unauthenticated local file inclusion bug. Cross-site scripting and missing authorization were the most common vulnerability types. 156 researchers contributed disclosures.
Vulnerability & Patch Roundup — September 2026
Matched: WordPress
Sucuri's September 2026 vulnerability and patch roundup highlights critical security updates for the WordPress ecosystem. The post warns that most breaches stem from automated attacks exploiting known, previously disclosed vulnerabilities. Site owners are urged to apply available patches promptly, as a single unpatched flaw can cause downtime, reputational damage, or costly remediation.
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026)
Matched: WordPress
Wordfence recorded 358 vulnerabilities across 243 WordPress plugins and 4 themes for the week of September 14–20, 2026. Of these, 311 were patched and 47 remain unpatched. Severity breakdown: 18 critical, 74 high, 262 medium, 4 low. Critical issues included backdoored software in Admin Menu Editor Pro, unauthenticated remote code execution in several plugins, authentication bypasses, and arbitrary file uploads. WordPress Core 7.1 received patches for stored XSS and several authorization flaws. 184 researchers contributed disclosures.
Hackers are targeting a critical WordPress flaw, so be on your guard
Matched: WordPress
A critical WordPress flaw (CVE-2026-87902), an unauthenticated path traversal bug scored 8.1, allows PHP file inclusion and potential remote code execution. Exploitation began within hours of a patch release, with attackers now writing malicious PHP files to disk across hundreds of IPs. A fix is available in WordPress 7.1.2, backported to version 4.7. Admins unable to update immediately should block traversal sequences in the pagename parameter and disable register_argc_argv.
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 7, 2026 to September 13, 2026)
Matched: WordPress
Wordfence reported 260 WordPress plugin vulnerabilities across 207 plugins for the week of September 7–13, 2026. Of these, 217 were patched, 42 remain unpatched, and one is partially patched. Severity breakdown: 184 medium, 66 high, 10 critical. Top critical issues included unauthenticated remote code execution in The Events Calendar and privilege escalation flaws in several plugins. 147 researchers contributed disclosures.
Wordfence Bug Bounty Program Monthly Report – May 2026
Matched: WordPress
Wordfence's May 2026 bug bounty report recorded 1,095 vulnerability submissions from 293 researchers, down 15% and 10.4% respectively from April. Of those, 149 were in-scope. Total bounties paid reached $34,454, with the highest single award of $6,436 going to a privilege escalation flaw in the Kirki plugin. Critical findings included authentication bypass in Burst Statistics, actively exploited file upload in Breeze Cache, and arbitrary file read in Avada Builder affecting one million sites.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)
Matched: WordPress
Wordfence disclosed 277 WordPress vulnerabilities across 187 plugins and 7 themes for the week of August 31–September 6, 2026. Sixteen were critical (CVSS 9.8), including unauthenticated privilege escalation, remote code execution, and arbitrary file upload flaws in plugins like Hummingbird, JetFormBuilder, Mail Mint, and MemberDash. Most vulnerabilities were patched; 23 remain unpatched. Cross-site scripting and missing authorization were the most common vulnerability types.
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)
Matched: WordPress
Wordfence recorded 246 WordPress vulnerabilities across 174 plugins and 5 themes for the week of August 24–30, 2026. Of these, 234 were patched and 12 remain unpatched. Severity breakdown: 18 critical, 73 high, 153 medium, 2 low. Critical issues included unauthenticated remote code execution in Avada and Drag and Drop Multiple File Upload for CF7, authentication bypasses in ManageWP Worker and WPMU DEV Dashboard, and a backdoor in Newspapers X. Firewall rules were immediately deployed for Premium users covering several high-risk flaws.
Vulnerability & Patch Roundup — August 2026
Matched: WordPress
Security researchers have compiled August 2026's key vulnerability patches for the WordPress ecosystem. Most breaches stem from automated attacks exploiting previously disclosed, known vulnerabilities. Unpatched flaws can take sites offline, damage reputations, or require costly remediation. The monthly roundup aims to help site owners maintain their security posture by staying current on critical updates.
Vulnerability & Patch Roundup — July 2026
Matched: WordPress
Sucuri's July 2026 patch roundup highlights key security vulnerabilities affecting the WordPress ecosystem. Most website compromises stem from automated attacks exploiting already-known flaws. The post urges site owners to apply updates promptly, noting that Sucuri Firewall users are already virtually protected against the listed vulnerabilities.
Why Delaying WordPress Updates Increases Security Risks
Matched: WordPress
Delaying WordPress updates leaves sites exposed to known vulnerabilities that attackers actively exploit. Once a patch is released, automated bots quickly scan thousands of sites for outdated core files, plugins, and themes. Sites don't need to be individually targeted — unpatched systems are found and attacked automatically, making timely updates one of the most effective basic security measures available.
Vulnerability & Patch Roundup — May 2026
Matched: WordPress
Security researchers have flagged multiple critical vulnerabilities across the WordPress ecosystem in May 2026, with automated attacks increasingly targeting known, unpatched flaws. The roundup highlights recent disclosures and available patches affecting WordPress core, plugins, and themes. Site owners are urged to apply updates promptly, as delays significantly increase the risk of compromise, downtime, and reputational damage.