WordPress security articles, guides, and announcements.
Tutor LMS shipped version 4.0.8 on September 10, 2026. The Tutor LMS vulnerability that update fixed, tracked as CVE-2026-78175, is a PHP object injection bug reachable by any logged-in subscriber, an...
On July 31, 2026, WPManageNinja's own update servers shipped backdoored builds of Fluent Forms Pro and Ninja Tables Pro straight through the plugin's real, trusted update channel. Nobody's code had a...
Wordfence reported on September 14, 2026 that attackers are actively exploiting a WooCommerce Wholesale Lead Capture vulnerability, CVE-2026-27540, and that its firewall has already blocked more than...
This is WP Vanguard's living patch list. It covers the WordPress plugin and theme flaws worth acting on right now, and we rebuild it every week at this same address instead of publishing a new post ea...
An attacker can plant a SQL payload on your WordPress site today and have it fire weeks later, the next time an admin restores a backup with the plugin. That is the shape of the All-in-One WP Migratio...
On August 25, 2026, ThemeFusion shipped two updates on the same day: Avada 7.16.1 and Fusion Builder 3.16.1. That wasn't a coincidence of release scheduling. CVE-2026-18431, an Avada theme vulnerabili...
Creative Mail, an email marketing plugin Constant Contact built for WordPress and WooCommerce stores, has an unauthenticated SQL injection with a CVSS score of 7.5 and no fixed version. CVE-2026-3985...
Wordfence's record, which feeds our vulnerability database, lists the FunnelKit vulnerability behind CVE-2026-47100 at CVSS 5.3, medium severity. The National Vulnerability Database scores the same bu...
GiveWP shipped version 4.16.7.2 on August 27, 2026, one day before the world learned why the update mattered. The GiveWP vulnerability behind that release, tracked as CVE-2026-82222, lets an attacker...
PHP's RSA decryption call returns `false` when it fails. It doesn't throw an exception, it just hands back a boolean. UpdraftPlus's remote communications code never checked for that boolean. It took w...