WordPress security articles, guides, and announcements.
Our database has logged 67,678 WordPress vulnerability disclosures since June 9, 2003, twenty-three years of advisories pulled mostly from Wordfence's threat intelligence feed. That number is a big pa...
Between 14:00 and 19:00 UTC on July 31, 2026, a decommissioned WPManageNinja update server, one nobody had switched off after a migration, started serving tampered builds of Fluent Forms Pro and Ninja...
WP Vanguard's vulnerability database logged 17 PHP object injection advisories against WordPress plugins in July 2026. In August, that count reached 43, roughly 2.5 times higher in a single month. Not...
CVE-2026-16230 carries a CVSS score of 9.8, critical, unauthenticated. The plugin is Formidable Digital Signatures, an add-on for Formidable Forms that lets site owners collect signed consent on a for...
Wishlist Member X, a membership plugin used to gate paid content behind a registration wall, has a registration handler that checks one parameter and acts on a different one. That gap is CVE-2026-1294...
On August 6, 2026, two critical CVEs landed against the same WordPress plugin on the same day. Both hit TrueBooker (Appointment Booking and Scheduler System), both scored CVSS 9.8, and both are a Word...
CVE-2026-14526 carries a CVSS score of 9.8 and needs no login at all. The plugin is AI Copilot - Content Generator, and every version up to and including 1.5.6 is affected. The fix shipped in 1.5.8, a...
Decoding a JWT is not verifying it. That distinction is the entire story of CVE-2026-8457, a critical authentication bypass in the WooCommerce - Social Login plugin, disclosed August 1, 2026. It carri...
On July 31, 2026, between 14:00 and 19:00 UTC, WPManageNinja's own update servers pushed backdoored builds of Fluent Forms Pro 6.2.7 and Ninja Tables Pro 5.2.11 to customer sites. This is one of the c...
July 2026 added 1,108 new WordPress vulnerabilities to our database, against 235 in June under the prior reporting methodology. That jump is real disclosure volume plus broader advisory aggregation la...