Wordfence logs 497 WordPress flaws from November 2–8
Original title: Wordfence Intelligence Weekly WordPress Vulnerability Report (November 2, 2026 to November 8, 2026)
Of those, 457 were patched and 40 remained unpatched, including 21 rated critical and 118 high.
Wordfence Intelligence added 497 vulnerabilities in 312 WordPress plugins and one theme for November 2 to November 8, 2026, with 218 researchers contributing. By its CVSS tally, 6 were low, 352 medium, 118 high, and 21 critical; 457 were patched and 40 unpatched. The largest types were improper input neutralization during page generation and missing authorization. Wordfence deployed firewall rule WAF-RULE-976 for paid customers while details stay redacted during vendor patching.
Unconfirmed: The excerpt does not name affected plugins or say whether any of the flaws are being exploited.
- Improper input neutralization during page generation accounted for 179 flaws.
- Missing authorization was next, with 108 entries.
- Paid Wordfence customers received WAF-RULE-976 immediately.
- Free Wordfence users get that rule after a 30-day delay.
| Product | Affected |
|---|---|
| WordPress plugins and one theme | — |
- 1.Review the November 2–8 Wordfence report against installed plugins and themes.
- 2.Expect WAF-RULE-976 on free Wordfence only after the stated 30-day delay.
From the original article
11 min read at wordfence.com
Last week, there were 497 vulnerabilities disclosed in 312 WordPress Plugins and 1 WordPress Theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 218 Vulnerability Researchers that contributed to WordPress Security last week. The post Wordfence Intelligence Weekly WordPress Vulnerability Report (November 2, 2026 to November 8, 2026) appeared first on Wordfence.
By Chloe Chamberland · wordfence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.