WordPress security articles, guides, and announcements.
A nulled WordPress plugin is a paid plugin that has been cracked to bypass its license check and redistributed for free. They show up on dozens of marketplaces with names like "free premium plugins,"...
The first half of May 2026 carried four high-severity WordPress disclosures across plugins with a combined install footprint above five million sites. The headline is a 9.8 critical authentication byp...
The fourth week of April 2026 added 216 new vulnerabilities to the WordPress ecosystem across 187 plugins and 29 themes. Of those, 187 have patches available and 29 remain unpatched. The headline stor...
A team of researchers presenting at the 2026 IEEE Symposium on Security and Privacy tested 17 third-party AI chatbot plugins running on more than 10,000 public WordPress sites. Eight of those plugins,...
Wordfence blocked 3,936 exploitation attempts against the Breeze caching plugin in a single 24-hour window. The flaw, tracked as CVE-2026-3844, lets unauthenticated attackers turn a feature designed t...
The AI Engine plugin for WordPress shipped a configuration that printed its Model Context Protocol bearer token directly into the public `/wp-json/` index. Any unauthenticated visitor could fetch that...
On April 5 and 6, 2026, thousands of WordPress sites running plugins from a single small author began serving SEO spam exclusively to Googlebot. The spam was invisible to site owners, invisible to sit...
On April 7, 2026, an unauthorized party gained access to Nextend's update infrastructure and pushed a trojanized build of Smart Slider 3 Pro, tagged 3.5.1.35, through the plugin's official auto-update...
A critical authentication bypass vulnerability tracked as **CVE-2026-1492** was disclosed this month in the **User Registration & Membership** plugin for WordPress. The flaw, rated CVSS 9.8, lets an u...
Every few weeks a critical vulnerability lands in a WordPress plugin and the write-up includes the same phrase: "the nonce check passed, but". The latest example is [CVE-2026-1492](/blog/user-registra...