WordPress security articles, guides, and announcements.
Veracode tested over 100 large language models on security-sensitive coding tasks, and 45% of the AI-generated code introduced an OWASP Top 10 vulnerability. That isn't a rounding error. It's close to...
Week 3 of May 2026 (May 11 to May 17) added 78 new vulnerabilities to the WordPress ecosystem across 62 plugins and 2 themes. Of those, 66 are patched and 12 remain unpatched at time of writing. The h...
In February 2026, an anonymous developer running a Mexico-based startup discovered their Google Gemini API key had been compromised. Within 48 hours, attackers had run up $82,314.44 in unauthorized ch...
WordPress 7.0 shipped on May 20, 2026. Three days after release, Patchstack founder Oliver Sild published the first AI-related security report against it: the new AI integration setup form lets the br...
Wordfence blocked more than 7,400 exploitation attempts against the Burst Statistics plugin in a single 24-hour window after disclosure. The bug, tracked as CVE-2026-8181, lets unauthenticated attacke...
A Subscriber-level WordPress account on a MonsterInsights site can steal the site owner's live Google OAuth access token and reset the Google Ads integration on the way out. The bug is tracked as CVE-...
The first half of May 2026 carried four high-severity WordPress disclosures across plugins with a combined install footprint above five million sites. The headline is a 9.8 critical authentication byp...
The fourth week of April 2026 added 216 new vulnerabilities to the WordPress ecosystem across 187 plugins and 29 themes. Of those, 187 have patches available and 29 remain unpatched. The headline stor...
A team of researchers presenting at the 2026 IEEE Symposium on Security and Privacy tested 17 third-party AI chatbot plugins running on more than 10,000 public WordPress sites. Eight of those plugins,...
Wordfence blocked 3,936 exploitation attempts against the Breeze caching plugin in a single 24-hour window. The flaw, tracked as CVE-2026-3844, lets unauthenticated attackers turn a feature designed t...
The AI Engine plugin for WordPress shipped a configuration that printed its Model Context Protocol bearer token directly into the public `/wp-json/` index. Any unauthenticated visitor could fetch that...
On April 5 and 6, 2026, thousands of WordPress sites running plugins from a single small author began serving SEO spam exclusively to Googlebot. The spam was invisible to site owners, invisible to sit...
On April 7, 2026, an unauthorized party gained access to Nextend's update infrastructure and pushed a trojanized build of Smart Slider 3 Pro, tagged 3.5.1.35, through the plugin's official auto-update...
A critical authentication bypass vulnerability tracked as **CVE-2026-1492** was disclosed this month in the **User Registration & Membership** plugin for WordPress. The flaw, rated CVSS 9.8, lets an u...
Wordfence disclosed an arbitrary file upload vulnerability in the Ninja Forms - File Upload plugin on April 6, 2026. The flaw allows unauthenticated attackers to upload arbitrary files to a WordPress...
A high-severity vulnerability in Perfmatters, one of the most popular WordPress performance optimization plugins, allows authenticated attackers with nothing more than a subscriber account to delete a...
The first week of April 2026 brought 225 new WordPress vulnerabilities across 203 plugins and 22 themes. Of those, 134 have patches available and 91 remain unpatched. The headline story is a cluster o...
A path traversal vulnerability in The Events Calendar -- one of the most widely installed WordPress plugins on the planet -- was publicly disclosed this week. There is no patch. Over 6 million WordPre...
Two WordPress themes disclosed this week with CVSS 9.8 privilege escalation vulnerabilities. One has a patch available. The other does not. Both allow attackers to go from little or no authentication...
Every week the WordPress ecosystem produces a fresh wave of vulnerability disclosures. Most site owners never hear about them until something goes wrong. This report covers every significant disclosur...
When we launched WP Vanguard, we had a simple goal: make professional-grade WordPress security scanning accessible to every site owner, not just enterprises with big budgets. A few months in, we have...
The WordPress ecosystem saw a sharp wave of security disclosures over the past week. Multiple critical and high-severity vulnerabilities surfaced across popular plugins and themes, with one flaw activ...
When attackers compromise a WordPress site, the malware you see is not the real problem. The real problem is the backdoor they leave behind. A backdoor is a hidden piece of code that gives the attack...