Wordfence 9.1.0 adds a news widget, faster rules and login logging
Firewall parsing is tighter, rule checks are more frequent, and PHP 8.6 compatibility is included for every license.
Stories per day · 30 days
3 RSS
Relatedwordpress19rce7race-condition6plugins5remote-code-execution5sql-injection3core-update2themes2unauthenticated2updraftplus2active-exploitation1backuply1bug-bounty1cms1core-upgrade1credential-theft1cross-site-scripting1cve-2026-939531
62 stories, newest first · one card per story
Stories tagged #wordfence
WordPress core flaw draws 240,000 exploit attempts (CVE-2026-119977)
Wordfence blocked the probes; counts are requests, not confirmed infections or sites compromised.
Wordfence logs 549 WordPress flaws, including core installer RCE
Seventeen were rated critical; 41 of 549 remain unpatched, and free firewall users get new rules after 30 days.
Wordfence to raise prices for Premium Care and Response
Annual prices increase from December 3 to fund AI threat research investments.
WordPress core RCE under active attack; Wordfence blocks 58,693 attempts
CVE-2026-119977 in WordPress 4.7 through 7.1.3 can yield unauthenticated PHP execution during brief upgrades; 7.1.4 patches it.
3
WordPress core RCE drew 60,471 attack attempts in 24 hours
Wordfence blocked the attempts after WordPress 7.1.4; the count does not show how many sites were compromised.
Attackers probe WordPress core race; 62,969 attempts in a day
Unauthenticated attackers can reach the installer under wp-content/upgrade only while a full core package is unpacking.
1
Attackers target fresh WordPress core update flaw hours after patch
The unauthenticated race condition can yield remote code execution only during a short core-update window; Wordfence has not confirmed compromises.
1
WordPress 7.1.4 fixes 22 flaws, including RCE under attack
Wordfence says unauthenticated RCE in WordPress 4.7 through 7.1.3 drew more than 18,500 exploit requests in 21 hours; successful compromises are not confirmed.
WordPress update RCE attacked hours after the 7.1.4 patch
Wordfence logged more than 18,500 requests to temporary installer paths in 21 hours; Core 4.7 through 7.1.3 is affected.
WordPress 7.1.4 fixes unauthenticated upgrade-window RCE under attack
Core 4.7 through 7.1.3 is affected; attackers poll a seconds-long staging window during full updates.
Wordfence July 2026 bounty program received 1,077 reports
Validated WordPress plugin and theme flaws are disclosed to vendors and can get firewall coverage.
Wordfence logs 268 WordPress flaws, 43 still unpatched
Of the week’s disclosures, 7 were critical and 69 high, spanning 182 plugins and 15 themes.
Wordfence opens a team for reporting active WordPress threats
Active exploitation, tampered updates, and mass campaigns can be emailed to threat-response@wordfence.com instead of general support.
Wordfence logs 497 WordPress flaws from October 12–18
Sixty-nine of the week's disclosures were still unpatched, including 23 rated critical, across plugins and themes.
PHP2Shell attack attempts continue with no confirmed compromises
Wordfence logged more than 74,000 related attempts; fixed PHP releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Stolen UpdraftCentral keys used to install malicious WordPress plugins
TeamUpdraft says its site was accessed October 17–18 and the database held UpdraftCentral, Vault, and Clone keys.
3
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026)
Wordfence logged 655 WordPress plugin and theme flaws last week, including core XSS and unauthenticated SQL injection.
600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin
Backuply through version 1.5.8 lets subscribers plant SQL that becomes administrator access on restore.
Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs into Thumbnails on Your Server
Wordfence disclosed Ghostscript CVE-2026-39919, a CVSS 9.8 flaw fixed in 10.08.0, with lab PDF remote code execution.
12
Attackers Exploit CVSS 10.0 Bricksforge WordPress Flaw Enabling Unauthenticated RCE
Attackers actively exploit CVSS 10.0 flaw CVE-2026-85097 in Bricksforge WordPress plugin for unauthenticated RCE.
5
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 28, 2026 to October 4, 2026)
Wordfence’s weekly report lists new WordPress vulnerabilities, but this excerpt names none.
Cybersecurity Imperatives Will Demand AI Math
Wordfence argues cybersecurity needs AI-driven math before public-key encryption fails.
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)
Wordfence published its weekly WordPress vulnerability report for disclosures made September 21–27, 2026.