Search: “wordfence”

15 items in the last 7d

Wordfence's May 2026 bug bounty monthly report logged 1,095 WordPress vulnerability submissions from researchers.

Wordfence's Bug Bounty Program received 1,095 vulnerability submissions in May 2026 from its researcher community. The Wordfence Threat Intelligence team reviews, triages, and processes submissions, responsibly disclosing validated vulnerabilities to WordPress ecosystem vendors. No specific flaws or exploitation details are provided in the report summary.

WordfenceSep 14, 13:58 UTC · 2d agoVulnerability

Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin

Wordfence Argus found two critical unauthenticated RCE vulnerability chains in The Events Calendar WordPress plugin, active on over 600,000 sites.

Wordfence Argus identified two independent critical vulnerability chains in The Events Calendar WordPress plugin on August 21-22, 2026. Both chains originate in the plugin's widget-rendering pipeline and can lead to unauthenticated Remote Code Execution via two separate methods. The plugin is active on more than 600,000 websites.

WordfenceSep 14, 16:53 UTC · 2d agoVulnerability

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)

Wordfence's weekly WordPress vulnerability report summarizes plugin and theme vulnerabilities disclosed and added to its database during the week ending September 6, 2026.

Wordfence published its weekly WordPress Vulnerability Report covering disclosures between August 31 and September 6, 2026. The report lists new vulnerabilities added to the Wordfence Intelligence Vulnerability Database and highlights contributors to WordPress Security. Administrators are advised to review the listed plugin and theme vulnerabilities to check whether their sites are affected.

WordfenceSep 10, 19:08 UTC · 6d agoAdvisory

Boost Engagement with Free Passkeys by Wordfence

Wordfence 9 introduces free passkey support, letting WordPress users log in without passwords and reducing authentication friction.

Wordfence announced that version 9 of its WordPress security plugin introduces passkeys. The feature removes the need for users to remember or copy passwords from a manager. Wordfence is offering the passkey capability for free.

WordfenceSep 15, 19:55 UTC · 1d agoTools

PHP Webshell Campaign Targets WordPress Through Critical WooCommerce Plugin Bug

Wordfence blocked over 100,000 exploitation attempts against CVE-2026-27540 in WooCommerce Wholesale Lead Capture, letting attackers upload PHP webshells to WordPress sites.

Wordfence reported more than 100,000 blocked exploitation attempts against CVE-2026-27540 in the WooCommerce Wholesale Lead Capture plugin (roughly 6,000 active installs), which was disclosed and patched on February 20 in version 2.0.3.2. The unauthenticated AJAX handler wwlc_file_upload_handler reads permitted file extensions from the attacker-controlled request, enabling arbitrary file upload of PHP files such as shell.php that report host details and serve further upload forms. Attack activity peaked between June 4 and June 17, 2026, with additional waves on July 1 and August 30. Wordfence rates the flaw CVSS 9.8, while Patchstack's CVE record lists 9.0.

Infosecurity MagazineSep 16, 15:00 UTC · 22h agoExploit / PoC in the wild 6 sources CVE-2026-27540

Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

Attackers actively exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture plugin to upload PHP webshells; patch shipped in version 2.0.3.2.

CVE-2026-27540 (CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin affects versions 2.0.3.1 and earlier across roughly 6,000 active installations. The unauthenticated AJAX handler wwlc_file_upload_handler trusts a client-supplied file_settings allowlist, letting attackers upload shell.php for remote code execution. Wordfence has blocked more than 100,000 exploit attempts since disclosure, with spikes in June, July, and August 2026. The vendor fixed the flaw in version 2.0.3.2.

GBHackersupdated Sep 16, 15:00 UTC · 22h agofirst Sep 15, 12:05 UTC · 2d agoExploit / PoC in the wild 6 sources CVE-2026-27540

Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells

Attackers exploit CVE-2026-27540 in WooCommerce Wholesale Lead Capture to upload PHP web shells; Wordfence blocked 100,000+ attempts since June 2026.

Wordfence reports active exploitation of CVE-2026-27540 (CVSS 9.8), an unauthenticated arbitrary file upload in the wwlc_file_upload_handler AJAX action of the WooCommerce Wholesale Lead Capture plugin (versions through 2.0.3.1, 6,000+ installs), enabling remote code execution via uploaded PHP web shells. Over 100,000 exploit attempts were blocked since June 2026, including 99 in the last 24 hours, traced to ten listed IP addresses. Separately, two critical flaws (CVE-2026-78159 and CVE-2026-78006) in The Events Calendar, installed on 600,000+ sites, allow unauthenticated RCE and full site takeover via PHP object injection chains. StellarWP patched the affected plugin versions 6.17.3 and 6.17.4 in releases 6.17.3.1 and 6.17.4.1.

The Hacker Newsupdated Sep 16, 15:00 UTC · 22h agofirst Sep 16, 05:48 UTC · 1d agoExploit / PoC in the wild 6 sources CVE-2026-27540 CVE-2026-78159 CVE-2026-78006

Hackers target WordPress sites via third-party WooCommerce plugin

Attackers exploit unauthenticated file-upload flaw CVE-2026-27540 in WooCommerce Wholesale Lead Capture plugin to install PHP webshells; Wordfence blocked 100,000+ attacks.

CVE-2026-27540 is an unauthenticated arbitrary file-upload vulnerability in the WooCommerce Wholesale Lead Capture premium plugin (versions 2.0.3.1 and older), caused by the exposed wwlc_file_upload_handler AJAX action trusting a user-controlled file_settings allowlist. Discovered by researcher Teemu Saarentaus, it was fixed in version 2.0.3.2 released February 20. Defiant reports Wordfence blocked over 100,000 attacks, with exploitation spikes between June 4-17, July 1, and August 30, delivering shell.php webshells for reconnaissance and additional payload uploads.

BleepingComputerupdated Sep 16, 15:00 UTC · 22h agofirst Sep 15, 14:45 UTC · 1d agoExploit / PoC in the wild 6 sources CVE-2026-275402· 1 read

WordPress Events Calendar Vulnerabilities Let Hackers Take Over 600,000 Websites

Two unauthenticated RCE flaws (CVSS 9.8) in The Events Calendar WordPress plugin threaten 600,000 sites; patched in 6.17.4.1.

Wordfence Argus disclosed two critical unauthenticated vulnerability chains in The Events Calendar WordPress plugin, tracked as CVE-2026-78006 and CVE-2026-78159, both scoring 9.8 CVSS. CVE-2026-78006 enables PHP object injection leading to RCE via a Lazy_Post_Collection gadget chain, while CVE-2026-78159 abuses Element_Classes::parse_array() to invoke wp_update_user() and reset the admin password. Exploitation works by injecting wp:legacy-widget Gutenberg markup through comments, using WordPress's moderation-preview hash to trigger the block before approval. StellarWP patched both flaws in version 6.17.4.1 after Wordfence's August 2026 disclosure.

GBHackersupdated Sep 16, 11:32 UTC · 1d agofirst Sep 15, 11:24 UTC · 2d agoVulnerability 3 sources CVE-2026-78006 CVE-2026-78159

Critical WordPress Plugin Flaws Put Over 600,000 Websites at Risk of Takeover

Two CVSS 9.8 flaws in The Events Calendar WordPress plugin expose 600,000+ sites to unauthenticated RCE and admin takeover.

Wordfence Argus discovered CVE-2026-78006 and CVE-2026-78159 (both CVSS 9.8) in StellarWP's The Events Calendar plugin, affecting over 600,000 active installations. CVE-2026-78006 exploits PHP object injection via crafted pending comments to execute OS commands; CVE-2026-78159 abuses a specially prepared array to call WordPress functions, enabling admin password resets and subsequent RCE. Both flaws are unauthenticated and patched in version 6.17.4.1, released after reports on August 21-22, 2026.

Cyber Security Newsupdated Sep 16, 11:32 UTC · 1d agofirst Sep 15, 10:01 UTC · 2d agoVulnerability 3 sources CVE-2026-78006 CVE-2026-78159

Hackers Exploit WooCommerce Plugin Bug to Take Over WordPress Sites Without Login

Attackers exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture to upload PHP webshells without authentication.

Attackers are actively exploiting CVE-2026-27540, a CVSS 9.8 unauthenticated file upload flaw in the WooCommerce Wholesale Lead Capture plugin (versions through 2.0.3.1, ~6,000 active sites). The plugin trusts a client-supplied list of allowed file types, letting attackers upload PHP webshells (shell.php) via the admin-ajax.php handler without any WordPress account. Wordfence blocked more than 100,000 exploit attempts, with activity bursts June 4-17, July 1, and August 30; a patch is available in version 2.0.3.2.

Cyber Security Newsupdated Sep 16, 15:00 UTC · 22h agofirst Sep 15, 11:41 UTC · 2d agoExploit / PoC in the wild 6 sources CVE-2026-27540

Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin

Attackers are actively exploiting an unauthenticated arbitrary file upload flaw in the WooCommerce Wholesale Lead Capture plugin, enabling PHP backdoors and remote code execution.

A critical unauthenticated arbitrary file upload vulnerability in WooCommerce Wholesale Lead Capture, a premium WordPress plugin with an estimated 6,000 active installations, was publicly disclosed on February 20, 2026. Wordfence reports attackers are now actively exploiting the flaw to upload arbitrary files, including PHP backdoors, and achieve remote code execution. No CVE ID was cited in the report.

WordfenceSep 14, 18:49 UTC · 2d agoExploit / PoC in the wild1

WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution

WordPress will automatically scan every plugin release and block high-risk updates from distribution using AI analysis plus Jetpack Scan.

WordPress announced automated security reviews for every plugin release during its cooldown period before distribution through the WordPress.org update API, combining AI models with Jetpack Scan into a security score. The system already caught a backdoor committed to a plugin with about 20,000 active installations on July 28, 2026, blocking it within 26 minutes of a Wordfence alert. Flagged patterns include missing capability checks, unsafe $wpdb queries, unserialize() on request data, and obfuscated code.

The Hacker NewsSep 14, 16:00 UTC · 2d agoTools

WordPress Blocks High-Risk Plugin Releases With New AI-Powered Automated Security Review

WordPress.org now runs AI-powered automated security reviews on every plugin release, automatically blocking high-risk updates before distribution to millions of sites.

WordPress launched an automated security review that combines multiple AI models and Jetpack Scan during a six-hour cooldown to score each plugin release; updates above the blocking threshold are automatically held back from the WordPress.org update API. The change follows a July 28 incident where a backdoor added to a plugin with roughly 20,000 active installations was detected during cooldown and never delivered; the Plugins Team removed it 26 minutes after a Wordfence notification. Blocked developers receive an email with findings and are advised to publish a corrected version rather than await manual appeal.

GBHackersSep 11, 05:49 UTC · 6d agoTools 2 sources1

WordPress Uses AI to Stop Malicious Plugin Updates Before They Reach Millions of Websites

WordPress.org now auto-blocks plugin updates flagged by AI review after a backdoor incident, adding a supply-chain gate for millions of sites.

Since June 5, 2026, every WordPress.org plugin and theme release passes a mandatory six-hour cooldown while multiple AI models and Jetpack Scan analyze code changes and produce a consolidated security score; releases above the risk threshold are blocked automatically. The change followed a July 28, 2026 incident where a backdoor was pushed into a plugin with roughly 20,000 active installs, which Wordfence flagged and the Plugins Team pulled 26 minutes later before distribution. Authors are notified of blocking findings and can republish corrected releases or appeal false positives to the Plugins Team.

Cyber Security Newsupdated Sep 11, 05:49 UTC · 6d agofirst Sep 10, 14:08 UTC · 6d agoTools 2 sources1