Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)
Wordfence published its weekly WordPress vulnerability report for disclosures made September 21–27, 2026.
Stories per day · 30 days
1 RSS
12 stories, newest first · one card per story
Stories tagged #plugin-security
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026)
Wordfence published its weekly WordPress vulnerability report for September 14–20, 2026.
Plugin4Shell Lets Repository Owners Swap Pinned Plugin Code Across Four AI Coding Agents
Air Security disclosed Plugin4Shell, letting repository owners swap version-locked plugins in Claude Code, Codex, GitHub Copilot, and Gemini CLI.
3
Over 100,000 WordPress Sites Exposed to RCE Through Tutor LMS Vulnerability
Wordfence disclosed CVE-2026-78175, an authenticated PHP object injection chain enabling RCE in Tutor LMS affecting 100,000+ WordPress sites; fixed in 4.0.8.
5
Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover
Two unauthenticated CVSS 9.8 code-injection and PHP object injection flaws in The Events Calendar plugin expose 200,000+ WordPress sites to RCE and takeover.
3
Plug 'n' Pray: Agentic LLM-based Detection of Potential Log File Exposures in Third-Party Content Management System Plugins
Agentic LLM analysis validates 79 log file exposures across 62 of the 300 most-installed WordPress plugins, covering 250M+ active installations.
WordPress Adds Automated Plugin Reviews to Block High-Risk Updates Before Distribution
WordPress will automatically scan every plugin release and block high-risk updates from distribution using AI analysis plus Jetpack Scan.
3
Wordfence Bug Bounty Program Monthly Report – May 2026
Wordfence's May 2026 bug bounty monthly report logged 1,095 WordPress vulnerability submissions from researchers.
WordPress adds automated security checks to block risky plugin releases
WordPress.org now automatically security-reviews every plugin release and blocks high-risk updates before distribution to millions of sites.
1
Wordfence Argus Finds Unauthenticated Arbitrary File Upload Vulnerability in Gravity Forms
Wordfence finds an unauthenticated arbitrary file upload flaw in Gravity Forms (1M+ installs) that can lead to remote code execution.
Wordfence Argus Finds Critical Authentication Bypass in WPMU DEV Dashboard Plugin
Wordfence researchers disclosed a critical unauthenticated authentication bypass in the WPMU DEV Dashboard plugin, enabling admin takeover and possible RCE.
Forminator WordPress Flaw Can Enable Unauthenticated RCE via Malicious PHP Uploads
Wordfence disclosed CVE-2026-15748, a critical unauthenticated file upload flaw enabling RCE in the Forminator Forms WordPress plugin, patched in version 1.56.2.
1