WordPress security articles, guides, and announcements.
WordPress 7.0 shipped on May 20, 2026. It brings the WP AI Client into core, raises the PHP floor, lands real-time collaborative editing, and ships responsive block visibility controls. Major version...
Every WordPress site running AI features is one careless plugin away from a leaked API key, an LLMjacking incident, or an unauthenticated privilege escalation. The plugin author may have a great produ...
Wordfence blocked more than 7,400 exploitation attempts against the Burst Statistics plugin in a single 24-hour window after disclosure. The bug, tracked as CVE-2026-8181, lets unauthenticated attacke...
A Subscriber-level WordPress account on a MonsterInsights site can steal the site owner's live Google OAuth access token and reset the Google Ads integration on the way out. The bug is tracked as CVE-...
A nulled WordPress plugin is a paid plugin that has been cracked to bypass its license check and redistributed for free. They show up on dozens of marketplaces with names like "free premium plugins,"...
The first half of May 2026 carried four high-severity WordPress disclosures across plugins with a combined install footprint above five million sites. The headline is a 9.8 critical authentication byp...
The fourth week of April 2026 added 216 new vulnerabilities to the WordPress ecosystem across 187 plugins and 29 themes. Of those, 187 have patches available and 29 remain unpatched. The headline stor...
A team of researchers presenting at the 2026 IEEE Symposium on Security and Privacy tested 17 third-party AI chatbot plugins running on more than 10,000 public WordPress sites. Eight of those plugins,...
Wordfence blocked 3,936 exploitation attempts against the Breeze caching plugin in a single 24-hour window. The flaw, tracked as CVE-2026-3844, lets unauthenticated attackers turn a feature designed t...
The AI Engine plugin for WordPress shipped a configuration that printed its Model Context Protocol bearer token directly into the public `/wp-json/` index. Any unauthenticated visitor could fetch that...