WordPress security articles, guides, and announcements.
From July 13 to October 11, 2026, our database logged 196 vulnerabilities in WordPress booking and appointment plugins. Eighty-nine of them, 45%, are authorization bugs: a missing permission check, or...
Three WordPress plugins fixed an unserialize vulnerability in the last 30 days: Booking Activities on September 11, String Locator on September 29 and MainWP Child on October 5. All three advisories r...
The WordPress plugin directory lists 15,901 plugins added in 2026. All of 2025 added 6,014. If you've felt like new WordPress plugins are everywhere, the numbers agree with you. Anyone with an AI codi...
ProfilePress, the membership and user-profile plugin installed on 100,000+ WordPress sites, has a vulnerability that lets any logged-in subscriber read other users' email addresses, login names and re...
Of the 57 critical WordPress vulnerabilities disclosed in September 2026, 51 needed no login. An attacker only had to find the site and send a request. The month also brought a second backdoored plugi...
Between August 3 and October 1, 2026, our database logged 85 critical or high-severity vulnerabilities in WordPress form plugins. Seventy-six of them need no login at all. Twenty score 9.0 or higher....
Two unrelated WordPress plugins disclosed local file inclusion bugs within a day of each other this week, and both trace back to the same design mistake: a shortcode attribute gets handed straight to...
ShortPixel Image Optimizer runs on about 300,000 WordPress sites. On September 17, 2026, Wordfence disclosed CVE-2026-17086 against every version up to and including 6.5.5, scored 8.8. An author-level...
In May 2026, our database logged unauthenticated stored XSS disclosures rated high or critical at a rate of about 5 a week. Over the ten weeks since late June, it has averaged roughly 32 a week. Two o...
The Events Calendar shipped two quiet security patches before anyone outside StellarWP knew why they mattered: 6.17.3.1 on August 26, 2026, and 6.17.4.1 on September 10, 2026. Wordfence explained the...
Tutor LMS shipped version 4.0.8 on September 10, 2026. The Tutor LMS vulnerability that update fixed, tracked as CVE-2026-78175, is a PHP object injection bug reachable by any logged-in subscriber, an...
An attacker can plant a SQL payload on your WordPress site today and have it fire weeks later, the next time an admin restores a backup with the plugin. That is the shape of the All-in-One WP Migratio...
On August 25, 2026, ThemeFusion shipped two updates on the same day: Avada 7.16.1 and Fusion Builder 3.16.1. That wasn't a coincidence of release scheduling. CVE-2026-18431, an Avada theme vulnerabili...
Creative Mail, an email marketing plugin Constant Contact built for WordPress and WooCommerce stores, has an unauthenticated SQL injection with a CVSS score of 7.5 and no fixed version. CVE-2026-3985...
Wordfence's record, which feeds our vulnerability database, lists the FunnelKit vulnerability behind CVE-2026-47100 at CVSS 5.3, medium severity. The National Vulnerability Database scores the same bu...
GiveWP shipped version 4.16.7.2 on August 27, 2026, one day before the world learned why the update mattered. The GiveWP vulnerability behind that release, tracked as CVE-2026-82222, lets an attacker...
PHP's RSA decryption call returns `false` when it fails. It doesn't throw an exception, it just hands back a boolean. UpdraftPlus's remote communications code never checked for that boolean. It took w...
WordPress core had a reflected XSS vulnerability on its login screen until August 6, 2026. That's when WordPress 7.0.3 fixed CVE-2026-64638, a bug in how `wp-login.php` handles a failed login attempt....
WordPress vulnerabilities logged in our database went from 1,721 in 2021 to 11,072 in 2025. That's a six-fold increase in four years, and 2026 is already at 7,620 disclosures as of September 12, on pa...
On August 19, 2026, Elementor shipped version 4.2.2 of Elementor Pro. Attacks against the flaw it patched started the same day. That's the part of this Elementor Pro vulnerability story that should wo...
PHP's `openssl_verify()` returns three possible values, not two. Most developers write code as though it returns two. That gap is the entire miniOrange SAML vulnerability tracked as CVE-2026-15981, CV...
Our database has logged 67,678 WordPress vulnerability disclosures since June 9, 2003, twenty-three years of advisories pulled mostly from Wordfence's threat intelligence feed. That number is a big pa...
Between 14:00 and 19:00 UTC on July 31, 2026, a decommissioned WPManageNinja update server, one nobody had switched off after a migration, started serving tampered builds of Fluent Forms Pro and Ninja...
WP Vanguard's vulnerability database logged 17 PHP object injection advisories against WordPress plugins in July 2026. In August, that count reached 43, roughly 2.5 times higher in a single month. Not...
CVE-2026-16230 carries a CVSS score of 9.8, critical, unauthenticated. The plugin is Formidable Digital Signatures, an add-on for Formidable Forms that lets site owners collect signed consent on a for...
Wishlist Member X, a membership plugin used to gate paid content behind a registration wall, has a registration handler that checks one parameter and acts on a different one. That gap is CVE-2026-1294...
On August 6, 2026, two critical CVEs landed against the same WordPress plugin on the same day. Both hit TrueBooker (Appointment Booking and Scheduler System), both scored CVSS 9.8, and both are a Word...
CVE-2026-14526 carries a CVSS score of 9.8 and needs no login at all. The plugin is AI Copilot - Content Generator, and every version up to and including 1.5.6 is affected. The fix shipped in 1.5.8, a...
Decoding a JWT is not verifying it. That distinction is the entire story of CVE-2026-8457, a critical authentication bypass in the WooCommerce - Social Login plugin, disclosed August 1, 2026. It carri...
July 2026 added 1,108 new WordPress vulnerabilities to our database, against 235 in June under the prior reporting methodology. That jump is real disclosure volume plus broader advisory aggregation la...
CVE-2026-15982 carries a CVSS score of 9.8 and needs no login. The flaw sits in a function called `aiomatic_call_google_ai_function`, part of Aimogen Pro, the "All-in-One AI Content Writer, Editor, Ch...
On July 7, 2026, researchers disclosed CVE-2026-12153, a missing authorization flaw in WP Learn Manager affecting every version up to and including 1.1.8. The CVSS score is 9.8, critical, unauthentica...
On July 7, 2026, two CVEs landed against the same plugin, Eventer, on the same day. One scored 7.5. The other scored 9.8. Neither number tells you what actually happened on a vulnerable site, because...
Three miniOrange plugins fixed critical, unauthenticated authentication bypass vulnerabilities inside eight days in July 2026. Every one of them scored 9.8 on CVSS. Every one let an attacker reach a W...
CVE-2026-13001 landed on July 14, 2026: a CVSS 9.8 unauthenticated arbitrary file upload vulnerability in Podlove Podcast Publisher, a WordPress plugin used to manage podcast feeds, episode metadata,...
Wordfence confirmed on September 3, 2026 that attackers are actively exploiting CVE-2026-14894, and its firewall has already blocked more than 250,000 exploit attempts against it. The bug lives in a `...
On July 6, 2026, the WPFunnels team shipped version 3.12.8 to close CVE-2026-14345, a critical remote code execution vulnerability rooted in how the plugin writes to and reads back its own log file. I...
CVE-2026-15158 carries a CVSS score of 9.8 and needs no authentication to exploit. The bug lives in Blocksy Companion's `save_attachments` function, in every version up to and including 2.1.46, and it...
On July 1, 2026, researchers disclosed CVE-2026-5524, a critical, unauthenticated arbitrary file upload vulnerability in Divi Form Builder, affecting every version up to and including 5.1.8. It carrie...
Within 24 hours of public disclosure on June 2, 2026, Wordfence blocked more than 222 exploit attempts against a single WordPress flaw. The target was Kirki, a freeform page builder and customizer wit...
June 2026 added 235 new WordPress vulnerabilities to our database across 206 plugins and 9 themes. Of those, 37 were rated critical (CVSS 9.0+). The headline is Kirki: an unauthenticated account-takeo...
Veracode tested over 100 large language models on security-sensitive coding tasks, and 45% of the AI-generated code introduced an OWASP Top 10 vulnerability. That isn't a rounding error. It's close to...
Week 3 of May 2026 (May 11 to May 17) added 78 new vulnerabilities to the WordPress ecosystem across 62 plugins and 2 themes. Of those, 66 are patched and 12 remain unpatched at time of writing. The h...
In February 2026, an anonymous developer running a Mexico-based startup discovered their Google Gemini API key had been compromised. Within 48 hours, attackers had run up $82,314.44 in unauthorized ch...
WordPress 7.0 shipped on May 20, 2026. Three days after release, Patchstack founder Oliver Sild published the first AI-related security report against it: the new AI integration setup form lets the br...
Wordfence blocked more than 7,400 exploitation attempts against the Burst Statistics plugin in a single 24-hour window after disclosure. The bug, tracked as CVE-2026-8181, lets unauthenticated attacke...
A Subscriber-level WordPress account on a MonsterInsights site can steal the site owner's live Google OAuth access token and reset the Google Ads integration on the way out. The bug is tracked as CVE-...
The first half of May 2026 carried four high-severity WordPress disclosures across plugins with a combined install footprint above five million sites. The headline is a 9.8 critical authentication byp...
The fourth week of April 2026 added 216 new vulnerabilities to the WordPress ecosystem across 187 plugins and 29 themes. Of those, 187 have patches available and 29 remain unpatched. The headline stor...
A team of researchers presenting at the 2026 IEEE Symposium on Security and Privacy tested 17 third-party AI chatbot plugins running on more than 10,000 public WordPress sites. Eight of those plugins,...
Wordfence blocked 3,936 exploitation attempts against the Breeze caching plugin in a single 24-hour window. The flaw, tracked as CVE-2026-3844, lets unauthenticated attackers turn a feature designed t...
The AI Engine plugin for WordPress shipped a configuration that printed its Model Context Protocol bearer token directly into the public `/wp-json/` index. Any unauthenticated visitor could fetch that...
On April 5 and 6, 2026, thousands of WordPress sites running plugins from a single small author began serving SEO spam exclusively to Googlebot. The spam was invisible to site owners, invisible to sit...
On April 7, 2026, an unauthorized party gained access to Nextend's update infrastructure and pushed a trojanized build of Smart Slider 3 Pro, tagged 3.5.1.35, through the plugin's official auto-update...
A critical authentication bypass vulnerability tracked as **CVE-2026-1492** was disclosed this month in the **User Registration & Membership** plugin for WordPress. The flaw, rated CVSS 9.8, lets an u...
Wordfence disclosed an arbitrary file upload vulnerability in the Ninja Forms - File Upload plugin on April 6, 2026. The flaw allows unauthenticated attackers to upload arbitrary files to a WordPress...
A high-severity vulnerability in Perfmatters, one of the most popular WordPress performance optimization plugins, allows authenticated attackers with nothing more than a subscriber account to delete a...
The first week of April 2026 brought 225 new WordPress vulnerabilities across 203 plugins and 22 themes. Of those, 134 have patches available and 91 remain unpatched. The headline story is a cluster o...
**Update, September 15, 2026:** This post originally said no patch existed for CVE-2026-3585. That was already wrong on the day it ran: The Events Calendar 6.15.17.1, which fixes it, shipped March 9,...
Two WordPress themes disclosed this week with CVSS 9.8 privilege escalation vulnerabilities. One has a patch available. The other does not. Both allow attackers to go from little or no authentication...
Every week the WordPress ecosystem produces a fresh wave of vulnerability disclosures. Most site owners never hear about them until something goes wrong. This report covers every significant disclosur...
When we launched WP Vanguard, we had a simple goal: make professional-grade WordPress security scanning accessible to every site owner, not just enterprises with big budgets. A few months in, we have...
The WordPress ecosystem saw a sharp wave of security disclosures over the past week. Multiple critical and high-severity vulnerabilities surfaced across popular plugins and themes, with one flaw activ...
When attackers compromise a WordPress site, the malware you see is not the real problem. The real problem is the backdoor they leave behind. A backdoor is a hidden piece of code that gives the attack...