WordPress security articles, guides, and announcements.
Attackers have been hitting the Bricksforge vulnerability, CVE-2026-85097, since October 7, 2026. Patchstack saw the first attempt at 21:47 UTC that day, and published its advisory the next day, Octob...
Rank Math PRO 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC contained malware, according to Rank Math's own incident notice. This Rank...
On September 14, 2026, an attacker got into the server behind adminmenueditor.com and published Admin Menu Editor Pro 2.35 with a web shell inside it. The developer pulled it and shipped a clean 2.36...
Wordfence reported on September 14, 2026 that attackers are actively exploiting a WooCommerce Wholesale Lead Capture vulnerability, CVE-2026-27540, and that its firewall has already blocked more than...
This is WP Vanguard's living patch list. It covers the WordPress plugin and theme flaws worth acting on right now, and we rebuild it every week at this same address instead of publishing a new post ea...
On July 31, 2026, between 14:00 and 19:00 UTC, WPManageNinja's own update servers pushed backdoored builds of Fluent Forms Pro 6.2.7 and Ninja Tables Pro 5.2.11 to customer sites. This is one of the c...