Wordfence logs 497 WordPress flaws from October 12–18
Original title: Wordfence Intelligence Weekly WordPress Vulnerability Report (October 12, 2026 to October 18, 2026)
Sixty-nine of the week's disclosures were still unpatched, including 23 rated critical, across plugins and themes.
Wordfence's weekly report says 497 vulnerabilities in 327 WordPress plugins and 23 themes were added to its database for October 12–18, 2026, with 218 researchers contributing. Of those, 428 were patched and 69 unpatched. Severity counts were 6 low, 315 medium, 153 high, and 23 critical. The largest CWE groups were cross-site scripting (159), missing authorization (116), and SQL injection (34). Premium, Care, and Response customers received new firewall rules immediately; free Wordfence users get them after 30 days. Two rule write-ups are redacted while vendors patch.
Unconfirmed: Details of WAF-RULE-966 and WAF-RULE-967 are withheld while vendors work on patches.
- Patched vulnerabilities: 428; unpatched: 69.
- Critical: 23; high: 153; medium: 315; low: 6.
- Other CWEs include 33 deserialization and 15 code-injection cases.
- WAF-RULE-966 and WAF-RULE-967 details are redacted pending patches.
- The database is described as holding over 40,000 vulnerabilities.
Impact: Plugin and theme flaws including XSS, missing auth, and SQL injection
| Product | Affected |
|---|---|
| WordPress plugins | — |
| WordPress themes | — |
- 1.Review plugins and themes against the October 12–18 Wordfence report.
- 2.Expect new Wordfence firewall rules immediately on Premium, Care, and Response, or after 30 days on the free version.
From the original article
11 min read at wordfence.com
Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to ...
By Chloe Chamberland · wordfence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.