WordPress security articles, guides, and announcements.
Two WordPress themes disclosed this week with CVSS 9.8 privilege escalation vulnerabilities. One has a patch available. The other does not. Both allow attackers to go from little or no authentication...
Every week the WordPress ecosystem produces a fresh wave of vulnerability disclosures. Most site owners never hear about them until something goes wrong. This report covers every significant disclosur...
When we launched WP Vanguard, we had a simple goal: make professional-grade WordPress security scanning accessible to every site owner, not just enterprises with big budgets. A few months in, we have...
Most WordPress site owners find out their site is down the same way their customers do: they try to visit it and get an error. They find out their SSL certificate expired when Chrome starts showing th...
The WordPress ecosystem saw a sharp wave of security disclosures over the past week. Multiple critical and high-severity vulnerabilities surfaced across popular plugins and themes, with one flaw activ...
You search for your own website and see it: "This site may be hacked" right below your listing in Google. Or worse, a full red interstitial page warning visitors away before they even reach your site....
In 2025, researchers found 11,334 new vulnerabilities in the WordPress ecosystem, a 42% jump from the year before. Sucuri scanned 70.8 million websites and flagged over 1.1 million as infected. Wordfe...
If you manage 50, 500, or 5,000 WordPress sites, running security scans one at a time is not practical, especially with [hundreds of new WordPress vulnerabilities disclosed every month](/blog/wordpres...
WordPress powers over 40% of the web. That also makes it the most targeted CMS on the planet. Outdated plugins, weak configurations, and [known vulnerabilities are exploited daily](/blog/how-wordpress...
Most WordPress site owners find out they have been hacked weeks or months after the initial breach. By then, the damage is done: search rankings have dropped, visitors are being redirected to spam sit...