WordPress security articles, guides, and announcements.
In March 2026 alone, security researchers logged 35 new vulnerabilities in AI-generated WordPress plugins. That single month produced more flaws than the entire second half of 2025. The tooling that w...
Researchers disclosed more than 40 CVEs against Model Context Protocol implementations in 2026, roughly one every four days, spread across the Python, TypeScript, Java, and Rust SDKs. That's a brand n...
Week 3 of May 2026 (May 11 to May 17) added 78 new vulnerabilities to the WordPress ecosystem across 62 plugins and 2 themes. Of those, 66 are patched and 12 remain unpatched at time of writing. The h...
The fastest way to turn a healthy WordPress site into a $50,000 cloud bill is to leak an AI API key. The fastest way to find out you've leaked one is when the bill arrives. The five minutes between th...
In February 2026, an anonymous developer running a Mexico-based startup discovered their Google Gemini API key had been compromised. Within 48 hours, attackers had run up $82,314.44 in unauthorized ch...
WordPress 7.0 shipped on May 20, 2026. Three days after release, Patchstack founder Oliver Sild published the first AI-related security report against it: the new AI integration setup form lets the br...
WordPress 7.0 shipped on May 20, 2026. It brings the WP AI Client into core, raises the PHP floor, lands real-time collaborative editing, and ships responsive block visibility controls. Major version...
Every WordPress site running AI features is one careless plugin away from a leaked API key, an LLMjacking incident, or an unauthenticated privilege escalation. The plugin author may have a great produ...
Wordfence blocked more than 7,400 exploitation attempts against the Burst Statistics plugin in a single 24-hour window after disclosure. The bug, tracked as CVE-2026-8181, lets unauthenticated attacke...
A Subscriber-level WordPress account on a MonsterInsights site can steal the site owner's live Google OAuth access token and reset the Google Ads integration on the way out. The bug is tracked as CVE-...