WordPress Vulnerability Roundup: September 2026

Of the 57 critical WordPress vulnerabilities disclosed in September 2026, 51 needed no login. An attacker only had to find the site and send a request. The month also brought a second backdoored plugin update in two months, a wave of file upload and privilege escalation bugs in form, registration and booking plugins, and a WordPress core flaw that attackers were using within hours of disclosure.

Our database lists 1,290 vulnerabilities for September across 749 plugins, 12 themes and WordPress core. 57 are critical, 318 are high and 907 are medium. Critical disclosures fell after two months of rises: August logged 100 by the same count.

These figures come from the database as it stands on October 4, and we counted August the same way so the two months compare fairly. They differ from our August roundup, which was written on August 30 and logged 929. Counts for a month keep rising for a while after it ends.

The Numbers This Month

Volume stayed almost flat, up 3%, while the critical count fell by 43%. The severity mix moved toward medium bugs, and the share of disclosures with a fix listed climbed from 85% to 91%. Recent months are always the least complete on that last figure, since a fix is often listed days after the advisory.

Key finding

A quieter critical count didn't mean a safer month. Nearly nine in ten critical bugs could be triggered by anyone on the internet, so the fewer bugs were just as easy to use.

Which Bug Classes Led

We counted advisory titles that name each class. One advisory can name more than one class and some name none, so the columns won't add up to the totals.

Cross-site scripting grew again and now accounts for roughly three in ten disclosures. We looked at why in our analysis of unauthenticated stored XSS. Almost everything else fell back from August's levels. Account takeover fell from 26 to 8, and remote code execution from 36 to 20.

Two Bug Families Behind the Critical List

Look past the totals and two classes account for much of the critical list. Eleven critical advisories name arbitrary file upload, and thirteen name privilege escalation. The same kind of plugin sits behind most of them: anything where a visitor can submit something.

File upload. An upload field that accepts the wrong file type is a complete takeover, because the file can be a PHP script. September's critical uploads included:

• Gravity Forms up to 3.1.0.4, through a hidden file upload field, fixed in 3.1.1.
• Ultimate Addons for Contact Form 7, two separate advisories, fixed in 3.5.51.
• WooCommerce Online Product Designer, fixed in 2.15.0.
• Drag and Drop File Upload for Elementor Forms, fixed in 1.6.1.
• MIPL Grouped Checkout Fields for WooCommerce, fixed in 1.2.3.

Privilege escalation. These let a visitor give themselves a higher role, usually through a request value the plugin trusted, such as the role parameter in Super Forms. Super Forms (fixed in 6.3.317), JetFormBuilder (3.6.2.1), Paytium (5.0.4), Authorizer (3.15.2), Amelia (9.6.3) and the Meta Box AIO family (3.12.0) all shipped this kind of flaw.

Forms, registration and booking plugins are public by design. That's what makes them useful and what makes a missing check serious. We went deeper on the form side in our research on form plugin vulnerabilities, and on the shared mistake behind file inclusion bugs in the shortcode template trick.

A Second Backdoored Update

In August, a forgotten update server at WPManageNinja shipped tampered builds. In September it happened again, to a different vendor. On September 14, an attacker got into the server behind adminmenueditor.com and published Admin Menu Editor Pro 2.35 with a web shell inside. The clean 2.36 that followed that evening was backdoored too, because the attacker still had access.

By the developer's own count, about 230 customers installed the bad build on at least 1,500 sites. There was no clean version to update to when we wrote our full breakdown of the backdoor, so the advice there is to roll back and clean up. It's the one September advisory where updating was the problem.

Two incidents in two months don't make a trend, but they do change how to treat update advice. Our guide on verifying that a plugin update is genuine covers what you can check before you apply an update, and what to do when an update misbehaves.

Under Attack in September

These were being exploited. If you run any of them and haven't updated, treat them as the first thing to do:

• WordPress core, CVE-2026-87902, fixed in 7.1.2, 7.0.6, 6.9.9 and 6.8.10. Attacks began within hours and CISA listed it on September 25. See what the vulnerability does.
• WooCommerce Wholesale Lead Capture, with Wordfence reporting more than 100,000 blocked attempts. See the writeup.
• Elementor Pro, exploited on patch day, through a form's File Upload field. See the writeup.
• UpdraftPlus and miniOrange SAML SSO, both covered in our weekly patch list.

Not everything critical was obscure. The Events Calendar, with more than 600,000 installs, had two unauthenticated remote code execution flaws, both fixed in 6.17.4.1. Forminator, also at 600,000 or more, had a shortcode execution bug fixed in 1.57.3. Hummingbird, at 70,000 or more, had an unauthenticated remote code execution flaw fixed in 3.21.1.

Critical Bugs With No Fix Listed

Thirteen critical advisories, across 12 plugins, had no fixed version listed when we checked. These are the ones to find on your sites and remove:

• The Pressengine, Frontegg SAML SSO, Login with QR and Private Feed Key: authentication bypass
• Advanced Customized Prompts: unauthenticated account takeover
• WooCommerce Request a Quote, DS Ad Rotator, Multi Uploader for Gravity Forms and WP images upload on piclect: arbitrary file upload
• Teddy Bear Customize Addon: file upload and privilege escalation, two advisories
• CryptoPayment Gateway: arbitrary file deletion
• Admin Menu Editor Pro: the backdoored build above

If you run any of them, deactivate and delete the plugin until a fix appears. Waiting for a patch on an unauthenticated critical bug is a bet that nobody finds your site first.

How We Counted

Every number here comes from our vulnerability database, which collects public advisories from sources like Wordfence and Patchstack. We counted by the date an advisory was published, between September 1 and 30.

One detail matters for the critical list. We count each affected plugin separately, so the 57 critical entries include 53 distinct CVE numbers. The main difference is Meta Box AIO, where one flaw is listed under three plugin names. Two more entries, Admin Menu Editor Pro and ACF Extended Pro, have no CVE number yet. A site running one plugin cares about one entry, so we count by plugin, not by CVE.

What to Do Now

1. List what has an update waiting, and apply the exploited ones first:

   wp plugin list --update=available --fields=name,version,update_version
   

2. Check form, registration and booking plugins by hand. They produced the most critical bugs this month. Update them, and if you run more than one form plugin on a site, remove the extras.

3. Search for the unpatched list above in your plugin inventory and delete any you find.

4. If you ever ran Admin Menu Editor Pro 2.35 or 2.36, follow our cleanup steps before anything else.

5. Look at your administrator list. A new account you didn't create is the most common trace left after one of these bugs:

   wp user list --role=administrator --fields=user_login,user_email,user_registered
   

For a baseline to work from, our security checklist covers the steps that still matter whatever the month brings. To check your own site against this month's list, run a free scan.

References

• WP Vanguard vulnerability database
• WordPress 7.1.2 release announcement
• Wordfence Intelligence vulnerability database
• Patchstack vulnerability database
• CISA Known Exploited Vulnerabilities catalog