WordPress Vulnerability Roundup: August 2026 Supply Chain

Between 14:00 and 19:00 UTC on July 31, 2026, a decommissioned WPManageNinja update server, one nobody had switched off after a migration, started serving tampered builds of Fluent Forms Pro and Ninja Tables Pro. Anyone who updated during that five-hour window, roughly 295 sites by the vendor's own count, got a plugin file with a passwordless admin account baked in. That single incident, tracked as CVE-2026-73532, is the reason this month's roundup can't lead with a table.

August 2026 logged 929 new WordPress vulnerabilities in our database, down from July's 1,108. Fewer disclosures, but not a quieter month: 75 of them are critical, up from 60 in July, and the patch rate slipped from 84.7% to 80.9%. Volume fell while severity rose and remediation got slower, three numbers that don't usually move in the same direction at once.

This WordPress vulnerability roundup for August 2026 follows July's report, where the defining pattern was Missing Authorization, plugins that checked a nonce and stopped there. August's story sits one layer up the stack: it's not about a plugin author skipping a permission check inside code they wrote. It's about what happens when the delivery channel for that code is itself compromised, and no permission check anywhere in the plugin would have caught it.

The Numbers This Month

The affected software splits across 881 vulnerabilities in 611 distinct plugin slugs, 39 vulnerabilities in 38 theme slugs, and 9 in WordPress core. Patch status: 752 patched, 177 unpatched at time of writing, an 80.9% patch rate. That's worse than July's 84.7%, and it's worse on a smaller base of total disclosures, which means the unpatched tail didn't shrink in step with volume the way you'd hope.

Read the severity and patch numbers together and the shape of August comes into focus. Total disclosures dropped 16% month over month. Critical disclosures rose 25%. Whatever slowed plugin authors down in July didn't carry into August, and the bugs that did land skewed toward the kind that gets a site fully owned rather than the kind that leaks a setting.

Vulnerability Classes: July Versus August

These counts are by classification, not a partition of the total. One advisory can carry two labels, an authentication bypass that's also account takeover, for instance, so the columns won't sum to either month's total.

Almost every row went down, which tracks with the total falling. PHP Object Injection didn't just buck that trend, it went the opposite direction hard: 17 disclosures in July, 43 in August. That's a 153% increase in a single class while overall volume fell 16%. Nothing else in the table moves like that.

How a Trusted Update Channel Becomes the Attack

Fluent Forms and Ninja Tables are both built by WPManageNinja, and both plugins share an internal license and update-checking codebase. According to the vendor's own incident report, a server used earlier in a migration was left running with the old update pipeline still wired up. When it got compromised, the attacker didn't need to find a bug in either plugin's code. They needed write access to a machine that both plugins already trusted to hand them their next version.

The payload that went out matched what you'd expect from someone who had time to plan it, not someone who found an opportunistic hole. A new file, libs/class-license-sync.php, got dropped into the plugin and wired in through a require_once added to the main plugin file. That file opened a backdoor REST route, wrote persistence into mu-plugins and the uploads directory, created an administrator account with no password, and registered scheduled tasks designed to survive the plugin being deleted. Deleting Fluent Forms Pro after infection would not have removed the backdoor.

Compare that to a normal critical disclosure, where a researcher finds a flaw, the vendor patches it, and everyone updates. Here the update was the attack. Every practice this blog and every other security blog recommends, stay current, update promptly, trust your plugin vendor's release channel, pointed a subset of WPManageNinja customers directly at the malicious build. We cover the full incident, including the specific files it dropped and how to check for them, in the dedicated writeup on the Fluent Forms and Ninja Tables backdoor.

The clean releases are Fluent Forms Pro 6.2.10 and Ninja Tables Pro 5.2.14. If you're running either plugin and updated between July 31 and when the vendor pulled the compromised builds, treat the site as compromised until you've checked for the indicators, not just updated the version number.

The Object Injection Spike

PHP Object Injection bugs happen when a plugin passes attacker-controlled data into PHP's unserialize(), and a class already loaded somewhere in WordPress core or another plugin has a magic method, __wakeup(), __destruct(), something that runs automatically when an object of that class is built. Chain the right classes together and unserializing a crafted string executes code, deletes files, or writes to the database, all without the attacker needing to find a traditional injection point.

WS Form LITE's advisory, CVE-2026-4703, is a clean example of the pattern: an unauthenticated object injection reachable without a login, fixed in 1.10.82. The jump from 17 to 43 disclosures in a single month isn't one plugin family repeating a shared bug, the way June's CRM cluster worked. It's a broader recognition problem: unserialize() calls that plugin authors treated as safe because the input "only" comes from a cookie, a saved option, or a REST parameter that isn't supposed to be user-facing, but is.

We're tracking the full scope of this shift, including which plugin categories are affected and what a safe migration to json_decode() looks like, in our surge analysis of August's PHP object injection wave. The short version: any code path that calls unserialize() on stored or transmitted data is worth auditing this month specifically, because the count says researchers are actively looking for this pattern right now.

Critical Spotlight: Ten Bugs Worth Knowing

Every one of these scores CVSS 9.8 and needs no authentication. We verified each against public advisory data before including it.

• CVE-2026-73532, Fluent Forms Pro <= 6.2.7 and Ninja Tables Pro <= 5.2.11: remote code execution via the WPManageNinja supply chain backdoor described above. Clean builds: 6.2.10 and 5.2.14.
• CVE-2026-8457, WooCommerce Social Login <= 2.8.7: authentication bypass via a forged Apple id_token. The plugin decoded the JWT payload without verifying its signature or checking the iss, aud, and exp claims, and the nonce needed to trigger login was exposed in a public JavaScript object. Fixed in 2.8.8.
• CVE-2026-12949, Wishlist Member X <= 3.34.1: account takeover via the mergewith parameter, which let an attacker's crafted registration overwrite an existing user's username, password, and email while WordPress's own change-notification emails stayed suppressed. Fixed in 3.34.2.
• CVE-2026-14364 and CVE-2026-14365, TrueBooker <= 1.2.3: two separate arbitrary password reset flaws. Fixed in 1.2.4.
• CVE-2026-14526, AI Copilot Content Generator <= 1.5.6: unauthenticated admin account creation through a workflow route. Fixed in 1.5.8.
• CVE-2026-16230, Formidable Digital Signatures <= 3.0.6: arbitrary file deletion. Fixed in 3.1.
• CVE-2026-19632, TranslatePress Multilingual <= 3.3.1: unauthenticated account takeover through leaked password-reset URLs, triggered when automatic string translation saves an admin's reset link into the plugin's own translation table for anyone to read. Fixed in 3.3.2.
• CVE-2026-4703, WS Form LITE <= 1.10.80: unauthenticated PHP object injection. Fixed in 1.10.82.
• CVE-2026-18781, Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9: unauthenticated remote code execution. Fixed in 1.3.9.9.
• CVE-2026-28185, Log in with Google <= 1.4.2: authentication bypass. Fixed in 1.4.3.

Four more didn't have a patch available at disclosure and are worth tracking by name if you run them: JSON Options <= 0.0.4 (CVE-2026-75860, remote code execution), Total Donations <= 2.0.5 (CVE-2026-78568, SQL injection), Piotnet Addons For Elementor Pro <= 7.1.67 (CVE-2026-28192, arbitrary file upload), and Automation Web Platform <= 4.8.6 (CVE-2026-77264, authentication bypass). If any of those are active on your sites, deactivating until a fix lands is the only reliable option right now.

Login and identity plugins keep showing up in the critical list. TranslatePress leaks reset tokens through its translation database, WooCommerce Social Login trusts an unsigned JWT, Log in with Google has its own bypass. July's spotlight had three miniOrange criticals in identity plugins; August's version of that pattern is more scattered across vendors, but the target keeps being the same: the code that decides who's logged in as whom.

What to Do Now

Start with whichever plugins from the list above you recognize, then work through the rest of your inventory with these specifics:

1. If you run Fluent Forms Pro or Ninja Tables Pro, check your update history first. Confirm you're on 6.2.10 or 5.2.14 or later, then look for the indicators from the vendor's incident report: an unexpected file at libs/class-license-sync.php, any administrator account you don't recognize, and scheduled events registered outside your normal cron jobs. A version bump alone doesn't remove a backdoor that was already dropped.
2. Update WooCommerce Social Login to 2.8.8 immediately if installed. The forged Apple token attack requires no interaction from the target and works against any account, including yours.
3. If you run TranslatePress with automatic translation enabled, update to 3.3.2 and rotate the admin password as a precaution, since a leaked reset link that was already scraped stays valid until used or expired.
4. Audit for unserialize() calls in any custom code or older plugins you maintain, especially anything processing cookies, saved settings, or REST payloads. This month's object injection numbers say that's where attackers are looking.
5. For general plugin hygiene beyond this month's specific bugs, our WordPress security checklist covers the baseline. With 177 disclosures from August still unpatched, don't treat "no fix yet" as "not urgent," especially for the four unpatched criticals named above.

References

• Patchstack vulnerability database
• WPManageNinja: Security Incident on July 31, 2026
• CVE-2026-73532 (Fluent Forms Pro) - VulnCheck advisory
• CVE-2026-8457 (WooCommerce Social Login) - GitHub Advisory Database
• CVE-2026-19632 (TranslatePress Multilingual) - The Hacker News
• CVE-2026-12949 (Wishlist Member X) - cvefeed.io