WordPress Vulnerability Roundup: June 2026

June 2026 added 235 new WordPress vulnerabilities to our database across 206 plugins and 9 themes. Of those, 37 were rated critical (CVSS 9.0+). The headline is Kirki: an unauthenticated account-takeover flaw on 500,000+ sites that attackers started exploiting within a day of disclosure. But the month's real story is a structural one, with PHP object injection and broken access control showing up again and again across unrelated plugins.

These figures come from the WP Vanguard vulnerability database, which aggregates public advisories from sources like Patchstack and Wordfence. This roundup covers the most important items and the patterns worth acting on. It's the follow-up to our May 2026 roundup.

The Numbers This Month

Patch status across all 235: 179 patched, 56 unpatched at time of writing. That's a 76% patch rate, a step down from May's 85%. The unpatched tail is concentrated, as usual, in low-install and abandoned plugins, but a 24% unpatched rate on a month with 37 criticals is a meaningful gap.

The critical count is the number to sit with. 37 critical disclosures in 30 days is more than one per day, and many of them require no authentication at all.

Vulnerability Classes: What Broke and Why

Sorting June's disclosures by type shows where plugin code keeps failing:

Three things stand out.

SQL injection back on top. After XSS led most of spring, June flipped to SQL injection with 24 disclosures. Most are in older plugins still concatenating strings into queries instead of using $wpdb->prepare(). The technique is a decade old and the fix is well documented, yet the count keeps refilling.

Broken access control at 20. This is the same root issue we wrote about in what WordPress nonces actually protect: an endpoint checks the nonce but never asks whether the user is allowed to perform the action. A nonce is a CSRF token, not a capability check. Twenty plugins shipped that confusion in June alone.

PHP object injection's bad month. Ten object-injection disclosures landed in June, and several were the same 9.8-severity bug in different products, which brings us to the supply-chain pattern below.

Critical Spotlight: Kirki Account Takeover

The most exploited bug of the month is CVE-2026-8206 in Kirki, a page builder and customizer on over 500,000 sites. An unauthenticated attacker can request a password reset for any username, supply their own email address, and receive a valid reset link for that account. Point it at admin and you own the site.

Wordfence blocked 222+ exploit attempts in the first 24 hours after disclosure. Versions 6.0.0 through 6.0.6 are affected; 6.0.7 fixes it. If you run Kirki, stop and update now, then check for rogue admin accounts. We break down the full attack chain and cleanup steps in Kirki Account Takeover: CVE-2026-8206 Explained.

The Shared-Code Supply Chain Problem

The pattern worth your attention this month is a cluster of CVSS 9.8 PHP object injection bugs in a family of CRM integration plugins: "Integration for ActiveCampaign and Contact Form 7," the matching Keap/Infusionsoft build, the Zendesk build, and the Insightly build. They are separate downloads with separate slugs, but they share a codebase, so one deserialization flaw reproduces across all of them at once.

This is the quiet risk in the plugin ecosystem. When a vendor ships the same engine under a dozen brand names, a single bug becomes a dozen advisories, and a site owner running two of those integrations has to patch both. If you use any "Integration for X and Contact Form 7" style plugin, check the vendor and update every plugin from that family together.

A handful of other criticals rounded out June at the top of the severity chart, including unauthenticated local file inclusion in Recover Exit for WooCommerce and BetterDocs Pro, arbitrary file upload in OMGF Pro, and arbitrary file deletion in WP User Manager. Confirm your installed versions against the advisories before assuming you're clear.

What to Do This Week

You don't need to read 235 advisories. You need to know whether anything you run is on the list.

1. Patch Kirki first if you use it. It's the one under active attack.
2. Inventory the CRM/Contact Form 7 integration plugins on your sites and update the whole family.
3. Update everything else and prioritize the 37 criticals over the medium tail.
4. Watch the unpatched 24%. If a plugin you depend on is in the unpatched group, consider replacing it.

For background on how these flaws turn into real compromises, see how WordPress sites get hacked, and run through the WordPress security checklist to close the common gaps before the next batch lands.

References

• Patchstack vulnerability database
• Wordfence Intelligence vulnerability feed
• Kirki CVE-2026-8206 (cvefeed.io)