Wordfence logs 268 WordPress flaws, 43 still unpatched
Original title: Wordfence Intelligence Weekly WordPress Vulnerability Report (October 19, 2026 to October 25, 2026)
Of the week’s disclosures, 7 were critical and 69 high, spanning 182 plugins and 15 themes.
Wordfence’s weekly report for October 19–25, 2026, added 268 vulnerabilities in 182 WordPress plugins and 15 themes, contributed by 124 researchers. Of those, 225 were patched and 43 remained unpatched. Severity counts were 7 critical, 69 high, 186 medium, and 6 low. The most common types were missing authorization (75) and improper input neutralization in web pages (69). Wordfence deployed a firewall rule for UpdraftPlus 1.26.11 and earlier, described as a UDRPC key compromise, immediately for Premium, Care, and Response customers.
Unconfirmed: The digest does not say whether any of the 268 flaws are being exploited.
- Deserialization of untrusted data accounted for 20 of the week’s flaws.
- Authorization bypass through a user-controlled key accounted for 16.
- SQL special-element flaws accounted for 13 disclosures.
- Free Wordfence users receive the UpdraftPlus rule after a 30-day delay.
- The report does not name CVE identifiers or confirm exploitation.
Impact: UDRPC key compromise and other plugin and theme flaws
| Product | Affected |
|---|---|
| UpdraftPlus | <= 1.26.11 |
- 1.Review the weekly report for plugins and themes in use
- 2.Premium, Care, and Response customers already have the UpdraftPlus firewall rule
- Vendors
- Wordfence
- Products
- UpdraftPlusWordPress
From the original article
12 min read at wordfence.com
Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to ...
By Chloe Chamberland · wordfence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.