WordPress security articles, guides, and announcements.
Attackers have been hitting the Bricksforge vulnerability, CVE-2026-85097, since October 7, 2026. Patchstack saw the first attempt at 21:47 UTC that day, and published its advisory the next day, Octob...
Rank Math PRO 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC contained malware, according to Rank Math's own incident notice. This Rank...
Between October 11 and October 18, 2026, our database logged 15 high-severity plugin disclosures whose titles say the attacker needs only a Subscriber or Contributor account. That is a subscriber leve...
From July 13 to October 11, 2026, our database logged 196 vulnerabilities in WordPress booking and appointment plugins. Eighty-nine of them, 45%, are authorization bugs: a missing permission check, or...
Three WordPress plugins fixed an unserialize vulnerability in the last 30 days: Booking Activities on September 11, String Locator on September 29 and MainWP Child on October 5. All three advisories r...
The WordPress plugin directory lists 15,901 plugins added in 2026. All of 2025 added 6,014. If you've felt like new WordPress plugins are everywhere, the numbers agree with you. Anyone with an AI codi...
ProfilePress, the membership and user-profile plugin installed on 100,000+ WordPress sites, has a vulnerability that lets any logged-in subscriber read other users' email addresses, login names and re...
Of the 57 critical WordPress vulnerabilities disclosed in September 2026, 51 needed no login. An attacker only had to find the site and send a request. The month also brought a second backdoored plugi...
Between August 3 and October 1, 2026, our database logged 85 critical or high-severity vulnerabilities in WordPress form plugins. Seventy-six of them need no login at all. Twenty score 9.0 or higher....
Ask someone to audit a WordPress site's security and they'll almost always start, and stop, in the same place: check plugin versions, look for weak passwords, maybe run a malware scan. That's real wor...