4 items in the last 3d
Wordfence 9 introduces free passkey support, letting WordPress users log in without passwords and reducing authentication friction.
Wordfence announced that version 9 of its WordPress security plugin introduces passkeys. The feature removes the need for users to remember or copy passwords from a manager. Wordfence is offering the passkey capability for free.
Attackers are actively exploiting an unauthenticated arbitrary file upload flaw in the WooCommerce Wholesale Lead Capture plugin, enabling PHP backdoors and remote code execution.
A critical unauthenticated arbitrary file upload vulnerability in WooCommerce Wholesale Lead Capture, a premium WordPress plugin with an estimated 6,000 active installations, was publicly disclosed on February 20, 2026. Wordfence reports attackers are now actively exploiting the flaw to upload arbitrary files, including PHP backdoors, and achieve remote code execution. No CVE ID was cited in the report.
Wordfence Argus found two critical unauthenticated RCE vulnerability chains in The Events Calendar WordPress plugin, active on over 600,000 sites.
Wordfence Argus identified two independent critical vulnerability chains in The Events Calendar WordPress plugin on August 21-22, 2026. Both chains originate in the plugin's widget-rendering pipeline and can lead to unauthenticated Remote Code Execution via two separate methods. The plugin is active on more than 600,000 websites.
Wordfence's May 2026 bug bounty monthly report logged 1,095 WordPress vulnerability submissions from researchers.
Wordfence's Bug Bounty Program received 1,095 vulnerability submissions in May 2026 from its researcher community. The Wordfence Threat Intelligence team reviews, triages, and processes submissions, responsibly disclosing validated vulnerabilities to WordPress ecosystem vendors. No specific flaws or exploitation details are provided in the report summary.