Wordfence July 2026 bounty program received 1,077 reports
Validated WordPress plugin and theme flaws are disclosed to vendors and can get firewall coverage.
18
Vendor
Wordfence
- Mentions · 7d3
- Mentions · 30d6
- All mentions32
- First seenAug 17, 2026
- Last mentioned1d ago
Timeline
32 articles · newest firstWordfence logs 268 WordPress flaws, 43 still unpatched
Of the week’s disclosures, 7 were critical and 69 high, spanning 182 plugins and 15 themes.
36
Wordfence opens a team for reporting active WordPress threats
Active exploitation, tampered updates, and mass campaigns can be emailed to threat-response@wordfence.com instead of general support.
22
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026)
Wordfence logged 655 WordPress plugin and theme flaws last week, including core XSS and unauthenticated SQL injection.
58
Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server
Wordfence disclosed Ghostscript CVE-2026-39919, a CVSS 9.8 flaw fixed in 10.08.0, with lab PDF remote code execution.
68
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)
Wordfence published its weekly WordPress vulnerability report for disclosures made September 21–27, 2026.
24
Scans for Wordfence Protected Websites, (Tue, Sep 29th)
SANS sensors saw sparse scans for wordfence-waf.php, likely probing Wordfence-protected WordPress sites.
32
Wordfence Bug Bounty Program Monthly Report – June 2026
Wordfence's June 2026 bug bounty report logged 1,066 WordPress vulnerability submissions.
18
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026)
Wordfence published its weekly WordPress vulnerability report for September 14–20, 2026.
18
Virginia governor creates an AI task force and moves to restrain data centers
Virginia Gov. Spanberger's Executive Order 22 creates an AI task force, bans data center NDAs, and moves to curb data center approvals.
45
Wordfence Argus Discovers Critical Vulnerability in libheif, the Library That Opens iPhone Photos on Your Server
Wordfence Argus disclosed a critical CVSS 9.8 flaw in libheif enabling protected-file disclosure and code execution on vulnerable server deployments.
58
Tutor LMS Flaw Exposes 100,000+ WordPress Sites to Remote Code Execution
A CVSS 8.8 PHP object injection flaw (CVE-2026-78175) in Tutor LMS exposes 100,000+ WordPress sites to subscriber-level remote code execution; patched in 4.0.8.
60
100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS
Wordfence found a PHP object injection flaw in Tutor LMS letting subscriber-level attackers achieve remote code execution on 100,000+ WordPress sites.
62
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 7, 2026 to September 13, 2026)
Wordfence's weekly report aggregates newly disclosed WordPress plugin and theme vulnerabilities for September 7–13, 2026.
15
PHP Webshell Campaign Targets WordPress Through Critical WooCommerce Plugin Bug
Wordfence blocked over 100,000 exploitation attempts against CVE-2026-27540 in WooCommerce Wholesale Lead Capture, letting attackers upload PHP webshells to WordPress sites.
60
WordPress Blocks High-Risk Plugin Releases With New AI-Powered Automated Security Review
WordPress.org now runs AI-powered automated security reviews on every plugin release, automatically blocking high-risk updates before distribution to millions of sites.
58
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)
Wordfence's weekly WordPress vulnerability report summarizes plugin and theme vulnerabilities disclosed and added to its database during the week ending September 6, 2026.
12
WordPress Uses AI to Stop Malicious Plugin Updates Before They Reach Millions of Websites
WordPress.org now auto-blocks plugin updates flagged by AI review after a backdoor incident, adding a supply-chain gate for millions of sites.
52
WordPress adds automated security checks to block risky plugin releases
WordPress.org now automatically security-reviews every plugin release and blocks high-risk updates before distribution to millions of sites.
55
Over 440,000 Exploit Attempts Target Super Forms and Elementor Pro RCE Flaws
Wordfence blocked 440,000+ exploit attempts against critical unauthenticated RCE flaws in WordPress plugins Super Forms and Elementor Pro.
80
Attackers Actively Exploiting Critical Vulnerability in Super Forms Plugin
Attackers are actively exploiting a critical unauthenticated file upload flaw in the Super Forms WordPress plugin to deploy PHP backdoors for RCE.
58
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)
Wordfence's weekly report summarizes newly disclosed WordPress ecosystem vulnerabilities added to its intelligence database for August 24-30, 2026.
12
Attackers Actively Exploiting Critical Vulnerability in Elementor Pro Plugin
Attackers actively exploit a critical unauthenticated file upload flaw in Elementor Pro (6M+ installs), enabling remote code execution and site takeover.
85
Wordfence Argus Finds Unauthenticated Arbitrary File Upload Vulnerability in Gravity Forms
Wordfence finds an unauthenticated arbitrary file upload flaw in Gravity Forms (1M+ installs) that can lead to remote code execution.
58
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
Unauthenticated second-order SQL injection found in All-in-One WP Migration and Backup plugin with 5+ million active installs.
60
Five Critical WordPress Plugin and Theme Flaws Enable Site Takeover or RCE
Five critical flaws (CVSS 9.8–10.0) in WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP enable WordPress admin takeover and RCE.
62
Wordfence Argus: Moving Beyond Human Research Capability
Wordfence showcases Argus, an AI agent for security research whose breakthrough findings required the AI itself to explain them.
25
Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin
Wordfence researchers disclosed a critical unauthenticated authentication bypass in the WPMU DEV Dashboard plugin, enabling admin takeover and possible RCE.
65
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 17, 2026 to August 23, 2026)
Wordfence logged 240 disclosed vulnerabilities across 184 WordPress plugins and 17 themes for the week of August 17-23, 2026.
26
Wordfence Argus Finds Complex 6 Step Critical RCE in Avada Theme with 1 Million Sales
Wordfence's AI-assisted Argus found a six-step critical RCE chain in the Avada WordPress theme, which has more than one million sales.
55
400,000 WordPress Sites Affected by Account Takeover Vulnerability in TranslatePress WordPress Plugin
Wordfence disclosed an unauthenticated account takeover flaw in the TranslatePress WordPress plugin, installed on over 400,000 sites, enabling full admin compromise.
73
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
Wordfence disclosed CVE-2026-15748, a critical unauthenticated file upload flaw enabling RCE in the Forminator Forms WordPress plugin, patched in version 1.56.2.
65
Related CVEs
by mentions- CVE-2026-148943%9.8The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 6.3.313 via the…
- CVE-2026-76581<1%9.8Unauthenticated Admin Authentication Bypass in WPMU DEV Dashboard 5.0.1 and earlier
- CVE-2026-195983%9.8Unauthenticated Privilege Escalation in WordPress Pods Plugin Enables Site Takeover
- CVE-2026-157484%9.8Unauthenticated RCE via Arbitrary File Upload in Forminator Forms WordPress Plugin
- CVE-2026-158264%9.8Unauthenticated Admin Login Bypass in WordPress User Profile Builder Plugin (≤3.16.4)
- CVE-2026-19632<1%9.8Unauthenticated Sensitive Information Exposure in TranslatePress WordPress Plugin
- CVE-2026-18431<1%9.8Unauthenticated Arbitrary File Write to RCE in Avada WordPress Theme
- CVE-2026-324752%9.0Unauthenticated PHP File Upload (RCE) in Elementor Pro WordPress Plugin
- CVE-2026-275403%9.0Unrestricted Upload of File with Dangerous Type vulnerability in Rymera Web Co Pty Ltd
- PHP Object Injection to RCE in Tutor LMS WordPress Plugin (≤ 4.0.7)
Appears with
- WordPressproduct · 20
- Wordfenceorganization · 14
- WordPressvendor · 7
- Patchstackvendor · 3
- Wordfence Argusproduct · 3
- WPMU DEVvendor · 3
- Jetpack Scanproduct · 3
- Elementorvendor · 2
- Tutor LMSvendor · 2
- Avadaproduct · 2
- TranslatePressproduct · 2
- Elementor Proproduct · 2
- Super Formsproduct · 2
- Automatticvendor · 2
- WPMU DEV Dashboardproduct · 2
- Wordfenceproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.