WordPress security articles, guides, and announcements.
On April 5 and 6, 2026, thousands of WordPress sites running plugins from a single small author began serving SEO spam exclusively to Googlebot. The spam was invisible to site owners, invisible to sit...
On April 7, 2026, an unauthorized party gained access to Nextend's update infrastructure and pushed a trojanized build of Smart Slider 3 Pro, tagged 3.5.1.35, through the plugin's official auto-update...
A critical authentication bypass vulnerability tracked as **CVE-2026-1492** was disclosed this month in the **User Registration & Membership** plugin for WordPress. The flaw, rated CVSS 9.8, lets an u...
Every few weeks a critical vulnerability lands in a WordPress plugin and the write-up includes the same phrase: "the nonce check passed, but". The latest example is [CVE-2026-1492](/blog/user-registra...
Most WordPress security tools charge a monthly subscription before you can do anything useful. WP Vanguard takes a different approach: the tools you need to stay informed about your site's security an...
Wordfence disclosed an arbitrary file upload vulnerability in the Ninja Forms - File Upload plugin on April 6, 2026. The flaw allows unauthenticated attackers to upload arbitrary files to a WordPress...
A high-severity vulnerability in Perfmatters, one of the most popular WordPress performance optimization plugins, allows authenticated attackers with nothing more than a subscriber account to delete a...
The first week of April 2026 brought 225 new WordPress vulnerabilities across 203 plugins and 22 themes. Of those, 134 have patches available and 91 remain unpatched. The headline story is a cluster o...
A path traversal vulnerability in The Events Calendar -- one of the most widely installed WordPress plugins on the planet -- was publicly disclosed this week. There is no patch. Over 6 million WordPre...
Two WordPress themes disclosed this week with CVSS 9.8 privilege escalation vulnerabilities. One has a patch available. The other does not. Both allow attackers to go from little or no authentication...