Wordfence logs 549 WordPress flaws, including core installer RCE
Original title: Wordfence Intelligence Weekly WordPress Vulnerability Report (October 26, 2026 to November 1, 2026)
Seventeen were rated critical; 41 of 549 remain unpatched, and free firewall users get new rules after 30 days.
Wordfence’s weekly report for October 26 to November 1, 2026, added 549 vulnerabilities in 351 WordPress plugins and 4 themes, contributed by 222 researchers. Of those, 508 were patched and 41 were not; ratings were 17 critical, 132 high, 394 medium and 6 low. New Premium firewall rules cover unauthenticated remote code execution in WordPress core 4.7.0–7.1.3 and The Grid 2.8.1 and earlier, plus unauthenticated file upload in YOOtheme Pro 5.0.0–5.0.52. Two further rules stay redacted while vendors are contacted.
Unconfirmed: Two firewall rules are redacted pending vendor patches, and the report does not say any flaw is being exploited.
- Cross-site scripting led CWE counts with 209 flaws, followed by 128 missing-authorization issues.
- The Grid at or below 2.8.1 has unauthenticated remote code execution.
- YOOOtheme Pro 5.0.0 through 5.0.52 allows unauthenticated arbitrary file upload.
- Premium, Care and Response customers received the new firewall rules immediately.
Impact: Unauthenticated remote code execution and arbitrary file upload
| Product | Affected |
|---|---|
| WordPress Core | 4.7.0 – 7.1.3 |
| The Grid | <= 2.8.1 |
| YOOOtheme Pro | 5.0.0 – 5.0.52 |
- 1.Review the weekly list and check whether listed plugins or themes are installed.
- 2.Update the 508 vulnerabilities Wordfence marks as patched.
- 3.Expect free Wordfence firewall coverage of these rules only after a 30-day delay.
From the original article
12 min read at wordfence.com
Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to ...
By Chloe Chamberland · wordfence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.