WordPress Vulnerability Roundup: June 2026

June 2026 added 235 new WordPress vulnerabilities to our database across 206 plugins and 9 themes. Of those, 37 were rated critical (CVSS 9.0+). The headline is Kirki: an unauthenticated account-takeover flaw on 500,000+ sites that attackers started exploiting within a day of disclosure. But the month's real story is a structural one, with PHP object injection and broken access control showing up again and again across unrelated plugins.

These figures come from the WP Vanguard vulnerability database, which aggregates public advisories from sources like Patchstack and Wordfence. This roundup covers the most important items and the patterns worth acting on. It's the follow-up to our May 2026 roundup.

The Numbers This Month

Patch status across all 235: 179 patched, 56 unpatched at time of writing. That's a 76% patch rate, a step down from May's 85%. The unpatched tail is concentrated, as usual, in low-install and abandoned plugins, but a 24% unpatched rate on a month with 37 criticals is a meaningful gap.

The critical count is the number to sit with. 37 critical disclosures in 30 days is more than one per day, and many of them require no authentication at all.

Vulnerability Classes: What Broke and Why

Sorting June's disclosures by type shows where plugin code keeps failing:

Three things stand out.

SQL injection back on top. After XSS led most of spring, June flipped to SQL injection with 24 disclosures. Most are in older plugins still concatenating strings into queries instead of using $wpdb->prepare(). The technique is a decade old and the fix is well documented, yet the count keeps refilling.

Broken access control at 20. This is the same root issue we wrote about in what WordPress nonces actually protect: an endpoint checks the nonce but never asks whether the user is allowed to perform the action. A nonce is a CSRF token, not a capability check. Twenty plugins shipped that confusion in June alone.

PHP object injection's bad month. Ten object-injection disclosures landed in June, and several were the same 9.8-severity bug in different products, which brings us to the supply-chain pattern below.

Critical Spotlight: Kirki Account Takeover

The most exploited bug of the month is CVE-2026-8206 in Kirki, a page builder and customizer on over 500,000 sites. An unauthenticated attacker can request a password reset for any username, supply their own email address, and receive a valid reset link for that account. Point it at admin and you own the site.

Wordfence blocked 222+ exploit attempts in the first 24 hours after disclosure. Versions 6.0.0 through 6.0.6 are affected; 6.0.7 fixes it. If you run Kirki, stop and update now, then check for rogue admin accounts. We break down the full attack chain and cleanup steps in Kirki Account Takeover: CVE-2026-8206 Explained.

The Shared-Code Supply Chain Problem

The pattern worth your attention this month is a cluster of CVSS 9.8 PHP object injection bugs in a family of CRM integration plugins: "Integration for ActiveCampaign and Contact Form 7," the matching Keap/Infusionsoft build, the Zendesk build, and the Insightly build. They are separate downloads with separate slugs, but they share a codebase, so one deserialization flaw reproduces across all of them at once.

This is the quiet risk in the plugin ecosystem. When a vendor ships the same engine under a dozen brand names, a single bug becomes a dozen advisories, and a site owner running two of those integrations has to patch both. If you use any "Integration for X and Contact Form 7" style plugin, check the vendor and update every plugin from that family together.

A handful of other criticals rounded out June at the top of the severity chart, including unauthenticated local file inclusion in Recover Exit for WooCommerce and BetterDocs Pro, arbitrary file upload in OMGF Pro, and arbitrary file deletion in WP User Manager. Confirm your installed versions against the advisories before assuming you're clear.

What to Do This Week

You don't need to read 235 advisories. You need to know whether anything you run is on the list.

1. Patch Kirki first if you use it. It's the one under active attack.
2. Inventory the CRM/Contact Form 7 integration plugins on your sites and update the whole family.
3. Update everything else and prioritize the 37 criticals over the medium tail.
4. Watch the unpatched 24%. If a plugin you depend on is in the unpatched group, consider replacing it.

For background on how these flaws turn into real compromises, see how WordPress sites get hacked, and run through the WordPress security checklist to close the common gaps before the next batch lands.

Update, October 4: June Today, and the Months After

The figures above are the counts we had when this post went up on June 27, three days before the month ended. Our database has changed since. For June it now lists 887 disclosures across plugins and themes, not 235, with 43 critical and 299 high. The critical count barely moved, from 37 to 43, so the headline that the month was heavy on critical bugs still holds. The bigger revision is in the high and medium tiers.

We haven't traced every part of the gap between 235 and 887. Late-arriving advisories explain some of it, and counts for a month keep rising after it ends. Treat the original numbers as a floor for June, not as its total, and don't compare them with the figures below.

Key finding

The June counts earlier in this post are early counts. Use them for what happened that month, and use the monthly table below to compare June with what followed.

Here is each month since, counted the same way, from the database as it stands today:

Three things stand out.

August was the peak for critical bugs. One hundred critical disclosures is more than double June. September fell back to 57, so the month still looks like a spike, not a new baseline.

The share with a fix keeps climbing. From 83% in June to 91% in September, with the caution that recent months are the least complete, because a fix is often listed days after an advisory. The unpatched tail we flagged in this post is real, but it shrinks as vendors catch up.

Some bug classes are flat and one is rising. Counting advisory titles that name each class:

SQL injection, the class we called back on top in June, stayed in a band of roughly 95 to 134 a month. Cross-site scripting grew by about 60% from June to September, which matches what we found when we looked closely at unauthenticated stored XSS. PHP object injection is lumpy, and the cluster of shared-code integration plugins described above explains a lot of its swings.

The practical advice from this roundup hasn't changed. Update what you run, put the exploited items first, and check your installed versions against a live list rather than waiting for a monthly summary. The weekly patch list is where we keep that list current.

References

• Patchstack vulnerability database
• Wordfence Intelligence vulnerability feed
• Kirki CVE-2026-8206 (cvefeed.io)