Wordfence Intelligence says 277 WordPress vulnerabilities were disclosed last week across 187 plugins and seven themes, with 153 researchers contributing findings to the database between August 31, 2026 and September 6, 2026. The weekly report shows a mix of patched and unpatched issues, but the sheer volume again underscores how quickly the WordPress ecosystem can accumulate security risk.
What the latest Wordfence Intelligence report covers
The report is designed as a snapshot of newly added vulnerability data in the Wordfence Intelligence Vulnerability Database. Wordfence says its goal is to make vulnerability information freely available through its user interface, database API, webhook integration, and Wordfence CLI Vulnerability Scanner, so site owners and security teams can act on it without cost barriers.
According to the company, organizations can use the CLI scanner to check sites regularly, or pull the full database through the API and receive real-time updates through webhooks. Wordfence also notes that users of the free plugin receive firewall protections after a 30-day delay, while Premium, Care, and Response customers get new protection immediately.
How the vulnerabilities were distributed
Last week’s disclosures were dominated by issues that could lead to site compromise, account takeover, or code execution. Wordfence’s breakdown shows that most of the newly cataloged problems were already patched, but a notable minority remained unpatched at the time of publication.
- Patched vulnerabilities: 254
- Unpatched vulnerabilities: 23
The severity mix was also weighted toward lower-impact issues overall, though the report still included 16 critical findings and 75 high-severity bugs.
- Low severity: 1
- Medium severity: 185
- High severity: 75
- Critical severity: 16
Recurring flaw types stand out in WordPress plugins and themes
Cross-site scripting remained the most common vulnerability class in the report, followed by missing authorization and privilege-escalation flaws. That pattern matters because many WordPress exploits begin with weak access control rather than complex technical chains.
- Cross-site scripting: 91
- Missing authorization: 52
- Authorization bypass through user-controlled key: 19
- Exposure of sensitive information: 17
- SQL injection: 16
- Improper privilege management: 14
- Deserialization of untrusted data: 10
- Path traversal: 9
- Code injection: 7
- Server-side request forgery: 7
Other reported weaknesses included CSRF, improper authentication, uncontrolled resource consumption, unrestricted file upload, command injection, open redirect, and unverified password change. Taken together, the list reflects the broad attack surface that popular plugins and themes can introduce when they handle authentication, uploads, file paths, or remote requests unsafely.
Wordfence deployed a new firewall rule
Wordfence said its Threat Intelligence Team reviewed each vulnerability for impact, severity, and likelihood of exploitation. In real time, the team deployed one enhanced firewall rule for Premium, Care, and Response customers.
- WAF-RULE-956 – data redacted while Wordfence works with the vendor on a patch.
That rule was made available immediately to paid customers, with free users scheduled to receive the same protection after the standard 30-day delay.
Notable critical findings from the week
The report highlights several critical vulnerabilities with CVSS scores of 9.8, including multiple unauthenticated privilege-escalation bugs and file-upload weaknesses. Several of the affected products are widely used, which increases the potential impact if administrators lag behind on updates.
- ACPT (Premium) <= 2.0.66 – Unauthenticated privilege escalation via
acpt_form_post_idparameter; CVE-2026-15354; patched; reported by d.v4n_s3c. - Advanced Custom Fields: Extended < 0.9.2.7 – Unauthenticated privilege escalation via administrator account takeover; CVE-2026-12526; patched; reported by Khaled Alenazi.
- Authorizer <= 3.15.1 – Unauthenticated privilege escalation; CVE-2026-81294; patched; reported by Steve.
- Booking for Appointments and Events Calendar – Amelia (Premium) 8.0 – 9.6.2 – Unauthenticated privilege escalation to administrator via
externalId; CVE-2026-9055; patched; reported by d.v4n_s3c. - Divi Ajax Filter <= 5.1.2 – Unauthenticated local file inclusion via
custom_loop_templateparameter; CVE-2026-11613; patched; reported by h0xilo. - Frontend Admin by DynamiApps <= 3.29.12 – Unauthenticated account takeover via
_acf_objectsobject identifier; CVE-2026-75816; patched; reported by thevietronin. - Hummingbird <= 3.21.0 – Unauthenticated remote code execution via cookie name in page cache debug log; CVE-2026-83627; patched; reported by Kuba.
- JetFormBuilder < 3.6.5.2 – Unauthenticated arbitrary shortcode execution; CVE-2026-19859; patched; reported by Jakub Herman.
- Mail Mint <= 1.31.0 – Unauthenticated PHP object injection in arbitrary form fields; CVE-2026-10196; patched; reported by maru.
- MemberDash <= 1.8.5 – Unauthenticated account takeover via insecure direct object reference; CVE-2026-16310; patched; reported by Foxyyy.
- MStore API <= 4.20.0 – Unauthenticated authentication bypass via
id_tokenparameter JWT forgery; CVE-2026-13447; patched; reported by t4g0. - Nokri – Job Board WordPress Theme <= 1.6.6 – Unauthenticated privilege escalation via
tokenparameter; CVE-2026-18550; patched; reported by d.v4n_s3c. - WPLP Cookie Consent <= 4.4.1 – Unauthenticated arbitrary file upload via
upload-logoREST endpoint; CVE-2026-75865; patched; reported by Supakiad S. (m3ez).
High-severity flaws also touched popular tools
The 8.8 and 8.1 findings were equally important because they affect plugins that many WordPress operators rely on for commerce, membership, forms, and backups. Several of these bugs could have enabled privilege escalation or code execution for authenticated attackers, while others exposed sites to object injection or arbitrary file deletion.
- Abandoned Cart Pro for WooCommerce <= 10.7.1 – missing authorization leading to authenticated subscriber+ privilege escalation; CVE-2026-81543; patched.
- DevKit Pro <= 2.3.0 – missing authorization to authenticated subscriber+ arbitrary theme installation / remote code execution via
qqfile; CVE-2026-14357; patched. - FS Poster <= 8.0.1 – authenticated subscriber+ remote code execution via FFmpeg path setting; CVE-2026-10195; patched.
- Really Simple Security < 9.8.0 – authenticated custom role+ remote code execution; CVE-2026-81766; patched.
- Support Genix <= 1.4.52 – authenticated subscriber+ authentication bypass to administrator account takeover via forged guest token; CVE-2026-19806; patched.
- Welcart e-Commerce <= 2.12.1 – unauthenticated arbitrary file deletion via PHP object injection; CVE-2026-19887; patched.
- Gravity Forms <= 3.0.2 – unauthenticated arbitrary file upload via state/chunk hash confusion; CVE-2026-19513; patched.
- JobSearch WP Job Board <= 3.2.0 – unauthenticated PHP object injection; CVE-2026-84834; unpatched.
- Ninja Forms – Layout & Styles <= 3.0.31 – unauthenticated PHP object injection; CVE-2026-81772; patched.
Researchers behind the disclosures
Wordfence credited 153 vulnerability researchers for last week’s additions. The top contributors were Wordfence PRISM with 17 findings, Ananda Dhakal with 12, Revanth Hari Narayana Matte with 11, and Jakub Herman with 9.
Other notable contributors included daroo, Artus KG, Osvaldo Noe Gonzalez Del Rio (Os), Erwan LR, d.v4n_s3c, Usama Arshad, Mohammed Abd Alrahman, Sai Praneeth Koti, theviper17y, and many more researchers across the report’s leaderboard. Wordfence also reiterated that security researchers can submit discoveries responsibly through its bug bounty program and be featured in future weekly reports.
What site owners should take away
The main lesson from this week’s report is not just that vulnerabilities are frequent, but that they remain concentrated in a long tail of plugins and themes used to extend core WordPress functionality. For administrators, that means fast patching, routine inventory checks, and layered controls matter just as much as the initial choice of software.
Wordfence’s advice is implicit in the structure of the report: keep plugins and themes updated, monitor for newly disclosed issues, and use automated scanning or feed integrations where possible. For sites that depend on multiple third-party extensions, even one overlooked update can turn a routine bug disclosure into a real incident.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More WordPress & CMS Tech News
Last Modified: September 11, 2026 at 10:33 pm
3 views
