WordPress.org now runs AI-powered automated security reviews on every plugin release, automatically blocking high-risk updates before distribution to millions of sites.
WordPress launched an automated security review that combines multiple AI models and Jetpack Scan during a six-hour cooldown to score each plugin release; updates above the blocking threshold are automatically held back from the WordPress.org update API. The change follows a July 28 incident where a backdoor added to a plugin with roughly 20,000 active installations was detected during cooldown and never delivered; the Plugins Team removed it 26 minutes after a Wordfence notification. Blocked developers receive an email with findings and are advised to publish a corrected version rather than await manual appeal.
Wordfence's weekly WordPress vulnerability report summarizes plugin and theme vulnerabilities disclosed and added to its database during the week ending September 6, 2026.
Wordfence published its weekly WordPress Vulnerability Report covering disclosures between August 31 and September 6, 2026. The report lists new vulnerabilities added to the Wordfence Intelligence Vulnerability Database and highlights contributors to WordPress Security. Administrators are advised to review the listed plugin and theme vulnerabilities to check whether their sites are affected.
WordPress.org now auto-blocks plugin updates flagged by AI review after a backdoor incident, adding a supply-chain gate for millions of sites.
Since June 5, 2026, every WordPress.org plugin and theme release passes a mandatory six-hour cooldown while multiple AI models and Jetpack Scan analyze code changes and produce a consolidated security score; releases above the risk threshold are blocked automatically. The change followed a July 28, 2026 incident where a backdoor was pushed into a plugin with roughly 20,000 active installs, which Wordfence flagged and the Plugins Team pulled 26 minutes later before distribution. Authors are notified of blocking findings and can republish corrected releases or appeal false positives to the Plugins Team.
WordPress.org now automatically security-reviews every plugin release and blocks high-risk updates before distribution to millions of sites.
The WordPress Official Plugin Repository Team launched an automated security review that scores each plugin and theme release during a six-hour cooldown, combining analysis from several AI models and Jetpack Scan, and automatically blocks releases deemed high risk. The change followed a July 28 detection of a backdoor committed to a release of a plugin with roughly 20,000 active installations; the release was withheld and the plugin closed for downloads 26 minutes after Wordfence notified the team. Blocked authors must fix findings and publish a new release scoring below the blocking threshold, or appeal to the Plugins Team.
Wordfence blocked 440,000+ exploit attempts against critical unauthenticated RCE flaws in WordPress plugins Super Forms and Elementor Pro.
Wordfence reports mass exploitation of two unauthenticated arbitrary file upload RCE flaws: CVE-2026-14894 in Super Forms (CVSS 9.8, fixed in 6.3.314) and CVE-2026-32475 in Elementor Pro (CVSS 9.0/9.8, fixed in 4.2.2), with over 250,000 and 190,000 blocked exploit attempts respectively. Attackers upload Base64-encoded PHP web shells such as Mushr00w_upl.php to execute code, create administrator accounts, exfiltrate data, or seize sites. Super Forms exploitation began July 14, 2026 and peaked above 40,000 requests on August 18; Elementor Pro attacks started August 19. Successful Elementor Pro exploitation requires a published page with a Form widget containing a File Upload field.
Attackers are actively exploiting a critical unauthenticated file upload flaw in the Super Forms WordPress plugin to deploy PHP backdoors for RCE.
Wordfence disclosed on July 9, 2026 a critical unauthenticated arbitrary file upload vulnerability in the Super Forms WordPress plugin, which has roughly 13,000 active installations. Unauthenticated attackers can upload arbitrary files, including PHP backdoors, to achieve remote code execution. The vendor now reports that attackers are actively exploiting the flaw in the wild.
Wordfence's weekly report summarizes newly disclosed WordPress ecosystem vulnerabilities added to its intelligence database for August 24-30, 2026.
Wordfence published its weekly WordPress vulnerability report covering disclosures added to the Wordfence Intelligence Vulnerability Database between August 24 and August 30, 2026. The report directs site owners to review the aggregated vulnerabilities to determine whether their sites are affected. The published text provides no specific CVE identifiers or affected products.
Attackers actively exploit a critical unauthenticated file upload flaw in Elementor Pro (6M+ installs), enabling remote code execution and site takeover.
Wordfence reports that attackers are actively exploiting a critical unauthenticated arbitrary file upload vulnerability in Elementor Pro, which it disclosed on August 19, 2026. The WordPress plugin has more than 6,000,000 active installations. Unauthenticated attackers can upload arbitrary files, including executable PHP files, leading to remote code execution and complete site takeover.
Wordfence finds an unauthenticated arbitrary file upload flaw in Gravity Forms (1M+ installs) that can lead to remote code execution.
On August 9, 2026, Wordfence's Argus scanner discovered an unauthenticated arbitrary file upload vulnerability in the WordPress plugin Gravity Forms, estimated at over one million active installations. Attackers can write files with attacker-selected extensions to a public temporary upload directory, potentially enabling remote code execution. The post does not mention a CVE identifier or observed exploitation.
Unauthenticated second-order SQL injection found in All-in-One WP Migration and Backup plugin with 5+ million active installs.
Wordfence received a submission on August 14, 2026 for an unauthenticated second-order SQL injection vulnerability in the All-in-One WP Migration and Backup WordPress plugin. The plugin has more than 5 million active installations. The disclosure text does not include a CVE id, a patch version, or evidence of exploitation.
Five critical flaws (CVSS 9.8–10.0) in WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP enable WordPress admin takeover and RCE.
Wordfence and Patchstack disclosed five critical flaws in WordPress plugins and themes: WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP. The issues include unauthenticated authentication bypass (CVE-2026-76581), arbitrary file write leading to RCE (CVE-2026-18431), administrator account takeover via password-reset URL exposure (CVE-2026-19632), privilege escalation (CVE-2026-19598), and PHP object injection to RCE (CVE-2026-82222, CVSS 10.0). Patchstack says the GiveWP flaw chains an unsafe unserialize helper, attacker-controlled donation data, and a gadget chain in shipped code.
Wordfence showcases Argus, an AI agent for security research whose breakthrough findings required the AI itself to explain them.
Wordfence describes Argus, an AI research agent the company says has moved beyond human research capability, producing a breakthrough so complex that the team asked the agent to write the explanatory blog post itself. The post functions as a vendor announcement of AI-driven vulnerability research capability. No specific CVEs, victims, or exploited products are detailed in the available text.
Wordfence researchers disclosed a critical unauthenticated authentication bypass in the WPMU DEV Dashboard plugin, enabling admin takeover and possible RCE.
During internal research on August 19, 2026, Wordfence discovered an authentication bypass in the WPMU DEV Dashboard WordPress plugin, which has roughly 350,000 active installations. Unauthenticated attackers can gain administrator access when Hub Single-Sign On is enabled, enabling complete site takeover. If an administrator-writable code mechanism such as the plugin or theme editor is available, the flaw can lead to remote code execution.
Wordfence logged 240 disclosed vulnerabilities across 184 WordPress plugins and 17 themes for the week of August 17-23, 2026.
Wordfence's weekly WordPress vulnerability report for August 17-23, 2026 added 240 vulnerabilities to its Intelligence Vulnerability Database, affecting 184 plugins and 17 themes. 105 vulnerability researchers contributed during the period. WordPress administrators are advised to review the list to check whether their sites use affected components.
Wordfence's AI-assisted Argus found a six-step critical RCE chain in the Avada WordPress theme, which has more than one million sales.
Wordfence reports that its Argus research uncovered a complex six-step exploit chain yielding critical remote code execution in the Avada WordPress theme, one of the best-selling themes with over one million sales. The company also notes AI-assisted submissions to its bug bounty program grew from 16% to roughly two-thirds of all reports in recent months. Sites running Avada should apply the patched release.
Wordfence disclosed an unauthenticated account takeover flaw in the TranslatePress WordPress plugin, installed on over 400,000 sites, enabling full admin compromise.
On August 11, 2026, Wordfence received a submission for an unauthenticated account takeover vulnerability in TranslatePress, a WordPress plugin with more than 400,000 active installations. Unauthenticated attackers can obtain an administrator's password reset link, reset the account's password, and log in as that administrator. Full compromise of the affected site is possible without any authentication. Exploitation in the wild was not reported at disclosure.
Wordfence disclosed CVE-2026-15748, a critical unauthenticated file upload flaw enabling RCE in the Forminator Forms WordPress plugin, patched in version 1.56.2.
Wordfence reported CVE-2026-15748 (CVSS 9.8) in Forminator Forms, a WordPress plugin with over 600,000 active installations, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution. The flaw stems from insufficient file type validation in the handle_file_upload() function, and exploitation requires a form containing both a File Upload field and a Select field, plus a custom upload storage root lacking .htaccess PHP protection. All versions up to and including 1.56.1 are affected; version 1.56.2 released July 31, 2026 fixes the issue. Wordfence also disclosed CVE-2026-15826 (CVSS 9.8), an authentication bypass in User Profile Builder (40,000+ installs) letting unauthenticated attackers log in as administrator, fixed in version 3.16.5 on July 16, 2026.
Unauthenticated PHP Object Injection Leading to RCE in GiveWP WordPress Plugin
CVE-2026-82222 is a deserialization of untrusted data flaw (CWE-502) in the GiveWP donation plugin for WordPress, developed by Liquid Web / StellarWP, affecting all versions through 4.16.7.1. The vulnerable code path is reachable over the network without authentication (CVSS vector AV:N/AC:L/PR:N), allowing an attacker to supply a crafted serialized object that the plugin unserializes, resulting in PHP object injection. By exploiting gadget chains in the plugin or WordPress core, the attacker can achieve remote code execution and run commands on the WordPress server, with the scope-changed CVSS rating and high confidentiality, integrity, and availability impacts indicating full site or server compromise is possible. Any WordPress site running GiveWP version 4.16.7.1 or older is affected, and because donation plugins are typically deployed on donor-facing public pages, the vulnerable endpoints are often directly exposed to the internet. A public proof-of-concept exists, but current exploitation risk is assessed as low: EPSS is 0.4% (35th percentile) and the flaw is not yet in CISA's Known Exploited Vulnerabilities catalog.
· Liquid Web / StellarWP GiveWP (WordPress plugin) all versions from n/a through 4.16.7.1 PoC large
Unauthenticated Privilege Escalation in WordPress Pods Plugin Enables Site Takeover
The Pods – Custom Content Types and Fields plugin for WordPress (all versions through 3.3.9) routes every access check on its pods_admin AJAX router — the method allowlist, nonce verification, login enforcement, and capability gate — through pods_error(), which in the JSON meta-box-loader compatibility path only writes a PHP error-log entry and returns false instead of terminating the request. As a result, an unauthenticated request sent through this AJAX path passes all of the plugin's guards without being stopped and can invoke privileged administrator actions. An attacker can escalate to Administrator or overwrite the password of any user account, including the site owner's, achieving complete site takeover or performing other administrator-level actions. Any WordPress site running an affected version of the plugin is exposed. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, though the 9.8 CVSS score and elevated EPSS (2.8%, 86th percentile) make it a high-priority patching target.
· Pods Foundation Pods – Custom Content Types and Fields (WordPress plugin) All versions up to and including 3.3.9mass
Unauthenticated RCE via Arbitrary File Upload in Forminator Forms WordPress Plugin
Forminator Forms, a widely used WordPress form-builder plugin, is vulnerable to an unauthenticated arbitrary file upload (CWE-434) in its handle_file_upload function in all versions up to and including 1.56.1. The weakness stems from insufficient file type validation: the dangerous-extension blocklist performs exact-key matching that is bypassed by pipe-alternative MIME type keys, while the public form-submission handler trusts upload field configuration that an attacker controls by forging a Select field value in a submitted form. An unauthenticated attacker can therefore upload files that may be executable, such as PHP scripts, achieving remote code execution with high impact to confidentiality, integrity, and availability (CVSS 3.1 score 9.8). Any WordPress site running Forminator Forms 1.56.1 or earlier, particularly those with publicly reachable forms, is affected. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently assigns a 4.6% probability of exploitation within 30 days (91st percentile).
· WPMU DEV Forminator Forms (WordPress plugin) All versions up to and including 1.56.1 (<= 1.56.1)large
Unauthenticated Admin Authentication Bypass in WPMU DEV Dashboard 5.0.1 and earlier
CVE-2026-76581 is a critical authentication bypass (CWE-347) in the WPMU DEV Dashboard plugin for WordPress, affecting all versions up to and including 5.0.1, caused by inconsistent HMAC message construction between the unauthenticated wdpsso_step1 and wdpsso_step2 AJAX actions: step 1 signs an unseparated concatenation of token, state, redirect, and domain, while step 2 verifies a concatenation that omits the domain field. An unauthenticated attacker can obtain a valid HMAC from step 1, move the domain value into the redirect field, and replay the signature to step 2, which accepts it and returns an authenticated administrator session. Only sites connected to WPMU DEV with Hub single sign-on (SSO) enabled and mapped to an administrator account are exploitable, and a successful attack grants full admin access, typically enabling complete site takeover. No exploitation has been reported: the flaw is not in CISA KEV, EPSS estimates a 0.3% probability of exploitation within 30 days, and no public proof-of-concept is known.
· WPMU DEV Dashboard (WordPress plugin) All versions up to and including 5.0.1large
Unauthenticated Sensitive Information Exposure in TranslatePress WordPress Plugin
TranslatePress – Translate Multilingual sites with AI Translation for WordPress, in all versions up to and including 3.3.1, leaks sensitive data through its unauthenticated 'trp_get_translations_regular' AJAX action (CWE-640). When automatic string saving is enabled (the plugin's default) and an administrator's profile locale is set to a published secondary language, the raw password-reset URL — containing the plaintext reset key and login parameters — is persisted in the secondary-language translation dictionary table. An unauthenticated attacker can then retrieve these stored strings via the AJAX endpoint and use the leaked reset key to take over the administrator account. Any WordPress site running the affected versions under those configuration conditions is exposed. No public proof-of-concept or confirmed exploitation is known; the flaw is not in CISA KEV and EPSS estimates a 0.8% probability of exploitation within 30 days.
· TranslatePress – Translate Multilingual sites with AI Translation (WordPress plugin) All versions up to and including 3.3.1large
Unauthenticated Arbitrary File Write to RCE in Avada WordPress Theme
CVE-2026-18431 is a critical (CVSS 9.8) arbitrary file write vulnerability in the Avada WordPress theme (all versions through 7.16) that is exploitable when the bundled Fusion Builder plugin (all versions through 3.16) is also installed and active. A chain of missing authorization (CWE-862) and input validation weaknesses across the two components allows unauthenticated attackers to write attacker-controlled files to the server. Because the attacker can create and execute arbitrary PHP files, successful exploitation leads to remote code execution and complete site compromise. Exploitation requires both components to be active and certain administrator-authored content to be present, narrowing the practical attack surface. No public proof of concept, in-the-wild exploitation, or KEV listing is currently known, and EPSS estimates only a 0.6% chance of exploitation within 30 days.
· ThemeFusion Avada theme for WordPress all versions up to and including 7.16 · ThemeFusion Fusion Builder plugin for WordPress all versions up to and including 3.16 (when installed and active)mass
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the sub
The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the submit_form function. This is due to missing file type validation and the absence of any capability check on the submit_form nopriv AJAX handler, whose only barrier is a session nonce freely obtainable by unauthenticated visitors via a separate nopriv endpoint. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. The nonce requirement is trivially bypassed…
Unauthenticated Admin Login Bypass in WordPress User Profile Builder Plugin (≤3.16.4)
CVE-2026-15826 is an unauthenticated authentication bypass caused by type confusion (CWE-704) in the User Profile Builder plugin for WordPress in all versions up to and including 3.16.4. The plugin's wppb_log_in_user() function calls absint() on the return value of wp_insert_user() before checking is_wp_error(); when a registration is submitted with a 61–70 character username, WordPress core returns a WP_Error object, but absint() coerces that object to the integer 1, so the plugin issues an autologin nonce bound to user ID 1 that the attacker can redeem to log in. As a result, an unauthenticated attacker can obtain a session as the site's Administrator account (user ID 1), achieving full administrative takeover of the site. Any WordPress site running the plugin at version 3.16.4 or earlier, with the plugin's registration/autologin flow reachable and user ID 1 holding an Administrator role, is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not in CISA KEV, though EPSS of 3.9% (90th percentile) suggests a moderate likelihood of exploitation within 30 days.
· Cozmoslabs User Profile Builder (Profile Builder) plugin for WordPress All versions up to and including 3.16.4large
Unauthenticated PHP File Upload (RCE) in Elementor Pro WordPress Plugin
Elementor Pro, the paid add-on to the widely used Elementor page builder for WordPress, is affected by an unrestricted upload of files with dangerous types (CWE-434) that can be triggered by unauthenticated attackers. An attacker sends a crafted upload request to the plugin's vulnerable endpoint and can upload a dangerous file — notably a PHP file — which the web server then executes, yielding remote code execution on the hosting account. The critical 9.0 CVSS score with scope change (S:C) and high impact across confidentiality, integrity and availability reflects that code execution lets an attacker take over the site, plant backdoors, modify content and potentially affect the underlying host. All Elementor Pro releases up to and including 4.2.1 are affected, meaning every site that has not yet updated to a fixed version is in scope. The flaw is not yet listed in CISA KEV and no public proof-of-concept is cataloged, and EPSS assigns a 2.4% 30-day exploitation probability (83rd percentile), but news reports already document hundreds of thousands of exploit attempts against Elementor Pro and Super Forms RCE flaws, so it should be treated as exploited in the wild.
· Elementor Pro (WordPress plugin) All versions from n/a through 4.2.1 (i.e., every release up to and including 4.2.1)mass
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.