ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Organization

Wordfence

3 mentions in 7 days · 7 in 30 days · 7 total · first seen · last

Search everything

Timeline

WordPress Blocks High-Risk Plugin Releases With New AI-Powered Automated Security Review

WordPress.org now runs AI-powered automated security reviews on every plugin release, automatically blocking high-risk updates before distribution to millions of sites.

WordPress launched an automated security review that combines multiple AI models and Jetpack Scan during a six-hour cooldown to score each plugin release; updates above the blocking threshold are automatically held back from the WordPress.org update API. The change follows a July 28 incident where a backdoor added to a plugin with roughly 20,000 active installations was detected during cooldown and never delivered; the Plugins Team removed it 26 minutes after a Wordfence notification. Blocked developers receive an email with findings and are advised to publish a corrected version rather than await manual appeal.

GBHackersupdated · 4d agofirst · 4d agoTools 7 sources1

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)

Wordfence's weekly WordPress vulnerability report summarizes plugin and theme vulnerabilities disclosed and added to its database during the week ending September 6, 2026.

Wordfence published its weekly WordPress Vulnerability Report covering disclosures between August 31 and September 6, 2026. The report lists new vulnerabilities added to the Wordfence Intelligence Vulnerability Database and highlights contributors to WordPress Security. Administrators are advised to review the listed plugin and theme vulnerabilities to check whether their sites are affected.

Wordfence · 5d agoAdvisory

WordPress Uses AI to Stop Malicious Plugin Updates Before They Reach Millions of Websites

WordPress.org now auto-blocks plugin updates flagged by AI review after a backdoor incident, adding a supply-chain gate for millions of sites.

Since June 5, 2026, every WordPress.org plugin and theme release passes a mandatory six-hour cooldown while multiple AI models and Jetpack Scan analyze code changes and produce a consolidated security score; releases above the risk threshold are blocked automatically. The change followed a July 28, 2026 incident where a backdoor was pushed into a plugin with roughly 20,000 active installs, which Wordfence flagged and the Plugins Team pulled 26 minutes later before distribution. Authors are notified of blocking findings and can republish corrected releases or appeal false positives to the Plugins Team.

Cyber Security Newsupdated · 4d agofirst · 5d agoTools 7 sources1

Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws

Wordfence blocked 440,000+ exploit attempts against critical unauthenticated RCE flaws in WordPress plugins Super Forms and Elementor Pro.

Wordfence reports mass exploitation of two unauthenticated arbitrary file upload RCE flaws: CVE-2026-14894 in Super Forms (CVSS 9.8, fixed in 6.3.314) and CVE-2026-32475 in Elementor Pro (CVSS 9.0/9.8, fixed in 4.2.2), with over 250,000 and 190,000 blocked exploit attempts respectively. Attackers upload Base64-encoded PHP web shells such as Mushr00w_upl.php to execute code, create administrator accounts, exfiltrate data, or seize sites. Super Forms exploitation began July 14, 2026 and peaked above 40,000 requests on August 18; Elementor Pro attacks started August 19. Successful Elementor Pro exploitation requires a published page with a Form widget containing a File Upload field.

The Hacker News · 11d agoExploit / PoC in the wildCVE-2026-14894CVE-2026-32475

5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin

Unauthenticated second-order SQL injection found in All-in-One WP Migration and Backup plugin with 5+ million active installs.

Wordfence received a submission on August 14, 2026 for an unauthenticated second-order SQL injection vulnerability in the All-in-One WP Migration and Backup WordPress plugin. The plugin has more than 5 million active installations. The disclosure text does not include a CVE id, a patch version, or evidence of exploitation.

Wordfence · 14d agoVulnerability

Wordfence Argus: Moving Beyond Human Research Capability

Wordfence showcases Argus, an AI agent for security research whose breakthrough findings required the AI itself to explain them.

Wordfence describes Argus, an AI research agent the company says has moved beyond human research capability, producing a breakthrough so complex that the team asked the agent to write the explanatory blog post itself. The post functions as a vendor announcement of AI-driven vulnerability research capability. No specific CVEs, victims, or exploited products are detailed in the available text.

Wordfence · 19d agoTools

400,000 WordPress Sites Affected by Account Takeover Vulnerability in TranslatePress WordPress Plugin

Wordfence disclosed an unauthenticated account takeover flaw in the TranslatePress WordPress plugin, installed on over 400,000 sites, enabling full admin compromise.

On August 11, 2026, Wordfence received a submission for an unauthenticated account takeover vulnerability in TranslatePress, a WordPress plugin with more than 400,000 active installations. Unauthenticated attackers can obtain an administrator's password reset link, reset the account's password, and log in as that administrator. Full compromise of the affected site is possible without any authentication. Exploitation in the wild was not reported at disclosure.

Wordfence · 21d agoVulnerability

Related CVEs

  • CVE-2026-148949.85%
    The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the sub
    The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler, whose only barrier is a session nonce freely obtainable by unauthenticated visitors via a separate nopriv endpoint. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce requirement is trivially bypassed…
    · WordPress—
  • CVE-2026-324759.02%
    Unauthenticated PHP File Upload (RCE) in Elementor Pro WordPress Plugin
    Elementor Pro, the paid add-on to the widely used Elementor page builder for WordPress, is affected by an unrestricted upload of files with dangerous types (CWE-434) that can be triggered by unauthenticated attackers. An attacker sends a crafted upload request to the plugin's vulnerable endpoint and can upload a dangerous file — notably a PHP file — which the web server then executes, yielding remote code execution on the hosting account. The critical 9.0 CVSS score with scope change (S:C) and high impact across confidentiality, integrity and availability reflects that code execution lets an attacker take over the site, plant backdoors, modify content and potentially affect the underlying host. All Elementor Pro releases up to and including 4.2.1 are affected, meaning every site that has not yet updated to a fixed version is in scope. The flaw is not yet listed in CISA KEV and no public proof-of-concept is cataloged, and EPSS assigns a 2.4% 30-day exploitation probability (83rd percentile), but news reports already document hundreds of thousands of exploit attempts against Elementor Pro and Super Forms RCE flaws, so it should be treated as exploited in the wild.
    · Elementor Pro (WordPress plugin) All versions from n/a through 4.2.1 (i.e., every release up to and including 4.2.1)mass

Appears with

vendor Wordfence 7product WordPress 4product Jetpack Scan 2vendor WordPress 2product All-in-One WP Migration and Backup 1product Elementor Pro 1product Super Forms 1product TranslatePress 1product Wordfence Argus 1product WordPress.org update API 1vendor All-in-One WP Migration and Backup 1vendor Automattic 1vendor Elementor 1vendor Jetpack 1vendor Patchstack 1vendor TranslatePress 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.