Wordfence (Product): news timeline & CVEs

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026)

Wordfence logged 655 WordPress plugin and theme flaws last week, including core XSS and unauthenticated SQL injection.

Wordfence's weekly report for October 5–11, 2026, added 655 vulnerabilities across 406 plugins and 100 themes, with contributions from 236 researchers. Of these, 21 were critical, 249 high, 377 medium, and 8 low; 366 were patched and 289 remained unpatched. Highlighted issues include unauthenticated stored cross-site scripting in WordPress Core 7.1 through 7.1.2 via pending comments, and unauthenticated SQL injection in Abandoned Cart Pro for WooCommerce 10.8.0 and earlier. Premium firewall rules were deployed immediately, while free Wordfence users receive them after 30 days.

WordfenceOct 15, 19:30 UTC · 1d agoVulnerability2

Scans for Wordfence Protected Websites, (Tue, Sep 29th)

SANS sensors saw sparse scans for wordfence-waf.php, likely probing Wordfence-protected WordPress sites.

The SANS Internet Storm Center reported that starting September 28 its sensors observed a small number of requests for wordfence-waf.php, a file created in a WordPress site root when Wordfence is installed. The requests were minimal, sending only a Host header set to the target IP address and no User-Agent. The file contains no secrets or configuration, but it loads scripts that run before WordPress code as part of Wordfence extended protection. Researcher Johannes Ullrich suggests the scans may enumerate protected sites or test direct-by-IP access that could bypass hostname-based firewall controls.

SANS Internet Storm CenterSep 29, 13:29 UTC · 17d agoResearch

Wordfence

Timeline2 articles

Appears with

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026)

Scans for Wordfence Protected Websites, (Tue, Sep 29th)