55
55
60
60
60
60
30
30
55
55
400,000 WordPress Sites Affected by Account Takeover Vulnerability in TranslatePress WordPress Plugin
Wordfence disclosed an unauthenticated account takeover flaw in the TranslatePress WordPress plugin, installed on over 400,000 sites, enabling full admin compromise.
On August 11, 2026, Wordfence received a submission for an unauthenticated account takeover vulnerability in TranslatePress, a WordPress plugin with more than 400,000 active installations. Unauthenticated attackers can obtain an administrator's password reset link, reset the account's password, and log in as that administrator. Full compromise of the affected site is possible without any authentication. Exploitation in the wild was not reported at disclosure.
73
42
60
60
Critical WordPress Plugin Bugs Exploited En Masse
60
55
42
47
42
55
30
55
55
60
60
30
60
30
55
42
35
42
55
WordPress Plugin Flaw Exposes 40,000 Sites to Admin Takeover
A critical unauthenticated flaw in the User Profile Builder WordPress plugin exposed roughly 40,000 sites to administrator account takeover.
Infosecurity Magazine reports a critical flaw in the User Profile Builder WordPress plugin that let unauthenticated attackers access administrator accounts. Approximately 40,000 sites were exposed to full admin takeover as a result. The report did not specify a CVE identifier or state whether exploitation was observed in the wild.
55
30
5 Million WordPress Sites Affected by SQL Injection Vulnerability in All-in-One WP Migration and Backup WordPress Plugin
Unauthenticated second-order SQL injection found in All-in-One WP Migration and Backup plugin with 5+ million active installs.
Wordfence received a submission on August 14, 2026 for an unauthenticated second-order SQL injection vulnerability in the All-in-One WP Migration and Backup WordPress plugin. The plugin has more than 5 million active installations. The disclosure text does not include a CVE id, a patch version, or evidence of exploitation.
60
30
60
35
47