WordPress security articles, guides, and announcements.
WordPress core had a reflected XSS vulnerability on its login screen until August 6, 2026. That's when WordPress 7.0.3 fixed CVE-2026-64638, a bug in how `wp-login.php` handles a failed login attempt....
In May 2026, the User Verification plugin for WordPress let an attacker log in as any verified user, including an administrator, by submitting `true` as their one-time passcode. No password guessing,...
WordPress vulnerabilities logged in our database went from 1,721 in 2021 to 11,072 in 2025. That's a six-fold increase in four years, and 2026 is already at 7,620 disclosures as of September 12, on pa...
On August 19, 2026, Elementor shipped version 4.2.2 of Elementor Pro. Attacks against the flaw it patched started the same day. That's the part of this Elementor Pro vulnerability story that should wo...
PHP's `openssl_verify()` returns three possible values, not two. Most developers write code as though it returns two. That gap is the entire miniOrange SAML vulnerability tracked as CVE-2026-15981, CV...
Our database has logged 67,678 WordPress vulnerability disclosures since June 9, 2003, twenty-three years of advisories pulled mostly from Wordfence's threat intelligence feed. That number is a big pa...
Between 14:00 and 19:00 UTC on July 31, 2026, a decommissioned WPManageNinja update server, one nobody had switched off after a migration, started serving tampered builds of Fluent Forms Pro and Ninja...
WP Vanguard's vulnerability database logged 17 PHP object injection advisories against WordPress plugins in July 2026. In August, that count reached 43, roughly 2.5 times higher in a single month. Not...
CVE-2026-16230 carries a CVSS score of 9.8, critical, unauthenticated. The plugin is Formidable Digital Signatures, an add-on for Formidable Forms that lets site owners collect signed consent on a for...
Wishlist Member X, a membership plugin used to gate paid content behind a registration wall, has a registration handler that checks one parameter and acts on a different one. That gap is CVE-2026-1294...