WordPress security articles, guides, and announcements.
Ask someone to audit a WordPress site's security and they'll almost always start, and stop, in the same place: check plugin versions, look for weak passwords, maybe run a malware scan. That's real wor...
WordPress.org closed WP Learn Manager's plugin listing on June 30, 2026, a week before a critical, unauthenticated vulnerability in it went public. The plugin didn't vanish from a single site that alr...
WooCommerce Wholesale Lead Capture's advisory reads: affected versions
Wordfence's firewall has blocked more than 100,000 exploit attempts against a single premium plugin, WooCommerce Wholesale Lead Capture. The flaw was disclosed on February 20, 2026, and Wordfence's Se...
On July 31, 2026, WPManageNinja's own update servers shipped backdoored builds of Fluent Forms Pro and Ninja Tables Pro straight through the plugin's real, trusted update channel. Nobody's code had a...
A developer copies the full contents of a sketchy plugin file, pastes it into ChatGPT, and types four words: "is this safe?" The model thinks for a second and replies, "Yes, this code looks secure and...
In March 2026 alone, security researchers logged 35 new vulnerabilities in AI-generated WordPress plugins. That single month produced more flaws than the entire second half of 2025. The tooling that w...
The fastest way to turn a healthy WordPress site into a $50,000 cloud bill is to leak an AI API key. The fastest way to find out you've leaked one is when the bill arrives. The five minutes between th...
WordPress 7.0 shipped on May 20, 2026. It brings the WP AI Client into core, raises the PHP floor, lands real-time collaborative editing, and ships responsive block visibility controls. Major version...
Every WordPress site running AI features is one careless plugin away from a leaked API key, an LLMjacking incident, or an unauthenticated privilege escalation. The plugin author may have a great produ...
A nulled WordPress plugin is a paid plugin that has been cracked to bypass its license check and redistributed for free. They show up on dozens of marketplaces with names like "free premium plugins,"...
Most WordPress security tools charge a monthly subscription before you can do anything useful. WP Vanguard takes a different approach: the tools you need to stay informed about your site's security an...
WordPress security pricing is all over the map. Some tools are free but limited. Others charge $500/year and include features you will never use. The result is that most site owners either overpay for...
Most WordPress security advice is either too vague ("keep your site secure") or too paranoid ("disable everything"). This checklist focuses on what actually prevents the majority of WordPress attacks,...