WordPress security articles, guides, and announcements.
Wordfence confirmed on September 3, 2026 that attackers are actively exploiting CVE-2026-14894, and its firewall has already blocked more than 250,000 exploit attempts against it. The bug lives in a `...
On July 6, 2026, the WPFunnels team shipped version 3.12.8 to close CVE-2026-14345, a critical remote code execution vulnerability rooted in how the plugin writes to and reads back its own log file. I...
CVE-2026-15158 carries a CVSS score of 9.8 and needs no authentication to exploit. The bug lives in Blocksy Companion's `save_attachments` function, in every version up to and including 2.1.46, and it...
On July 1, 2026, researchers disclosed CVE-2026-5524, a critical, unauthenticated arbitrary file upload vulnerability in Divi Form Builder, affecting every version up to and including 5.1.8. It carrie...
Within 24 hours of public disclosure on June 2, 2026, Wordfence blocked more than 222 exploit attempts against a single WordPress flaw. The target was Kirki, a freeform page builder and customizer wit...
June 2026 added 235 new WordPress vulnerabilities to our database across 206 plugins and 9 themes. Of those, 37 were rated critical (CVSS 9.0+). The headline is Kirki: an unauthenticated account-takeo...
A developer copies the full contents of a sketchy plugin file, pastes it into ChatGPT, and types four words: "is this safe?" The model thinks for a second and replies, "Yes, this code looks secure and...
Veracode tested over 100 large language models on security-sensitive coding tasks, and 45% of the AI-generated code introduced an OWASP Top 10 vulnerability. That isn't a rounding error. It's close to...
Roughly 76% of newly observed malware now exhibits AI-driven polymorphism, regenerating itself in real time to dodge whatever scanned it last. That single number explains why so many WordPress sites g...
It's 9:14 on a Tuesday morning. You open your inbox and the second email stops you cold. The subject line reads "Urgent: Malware detected on yourdomain.com." The sender looks like your host. The logo...