WordPress security articles, guides, and announcements.
On September 14, 2026, an attacker got into the server behind adminmenueditor.com and published Admin Menu Editor Pro 2.35 with a web shell inside it. The developer pulled it and shipped a clean 2.36...
Wordfence reported on September 14, 2026 that attackers are actively exploiting a WooCommerce Wholesale Lead Capture vulnerability, CVE-2026-27540, and that its firewall has already blocked more than...
This is WP Vanguard's living patch list. It covers the WordPress plugin and theme flaws worth acting on right now, and we rebuild it every week at this same address instead of publishing a new post ea...
On July 31, 2026, between 14:00 and 19:00 UTC, WPManageNinja's own update servers pushed backdoored builds of Fluent Forms Pro 6.2.7 and Ninja Tables Pro 5.2.11 to customer sites. This is one of the c...