Wordfence Intelligence says 497 WordPress vulnerabilities were disclosed last week across 312 plugins and one theme, with 218 researchers contributing to the database between November 2, 2026 and November 8, 2026. The report also notes one new firewall rule deployed in response to a high-risk issue, while Wordfence customers with paid protection received that coverage immediately.
A busy week for WordPress security
The weekly Wordfence Intelligence vulnerability report is designed to give site owners a fast way to check whether their plugins or theme stack overlaps with newly disclosed issues. Wordfence says the database now includes more than 40,000 vulnerabilities, and that its user interface, API, and webhook integrations are free for both personal and commercial use.
That focus on broad access matters because the volume of disclosures remains high. Of the 497 vulnerabilities added last week, 457 were already patched and 40 were still unpatched at the time of the report.
Severity skewed toward medium and high risk
The severity mix suggests a week dominated by exploitable but not always catastrophic bugs. Wordfence categorized 352 issues as medium severity, 118 as high severity, 21 as critical, and 6 as low severity.
While “medium” sounds less alarming than “critical,” those issues can still be important in real-world attacks, especially when they involve authentication, authorization, or unsafe data handling. Wordfence’s report is intended to help site operators prioritize patching rather than simply count advisories.
Severity breakdown
- Low severity: 6
- Medium severity: 352
- High severity: 118
- Critical severity: 21
Common bug patterns point to familiar WordPress risk areas
The report’s CWE breakdown highlights recurring classes of weakness rather than one-off mistakes. The most common category was Improper Neutralization of Input During Web Page Generation, with 179 issues, followed by Missing Authorization with 108.
Other frequent problem areas included Improper Privilege Management, Improper Control of Generation of Code, Exposure of Sensitive Information to an Unauthorized Actor, and Authorization Bypass Through User-Controlled Key. Together, these patterns reinforce how often plugin vulnerabilities stem from access-control failures, unsafe input handling, and insufficient validation.
Most common CWE types
- Improper Neutralization of Input During Web Page Generation: 179
- Missing Authorization: 108
- Improper Privilege Management: 29
- Improper Control of Generation of Code: 28
- Exposure of Sensitive Information to an Unauthorized Actor: 27
- Authorization Bypass Through User-Controlled Key: 25
- Improper Neutralization of Special Elements used in an SQL Command: 19
Firewall protection rolled out for a redacted issue
Wordfence said its Threat Intelligence team reviewed each vulnerability for impact, severity, and likely exploitability before deciding whether the firewall needed new coverage. Last week, the team deployed enhanced protection for one vulnerability, identified as WAF-RULE-976, though the underlying details were redacted while the company worked with the vendor on a patch.
Premium, Care, and Response customers received that protection in real time. Users of the free Wordfence plugin will get the same rule after a 30-day delay, which is consistent with Wordfence’s standard rollout model.
Large plugins and security-sensitive tools appear throughout the list
The plugin list is broad and includes everything from page builders and form plugins to backup tools, booking systems, membership products, payment integrations, and ecommerce extensions. Some of the named products are widely used on WordPress sites, including Advanced Custom Fields, Elementor, Contact Form 7, WPBakery Page Builder, WooCommerce Stripe Payment Gateway, LiteSpeed Cache, WPForms, The Events Calendar, and Duplicator.
That breadth is important because vulnerabilities in high-deployment plugins can have a wider security footprint than niche bugs. Site owners often install multiple extensions that touch login flows, uploads, payments, or content publishing, which means the risk can compound across a single site.
Examples from the reported plugin list
- Advanced Custom Fields
- Elementor
- Contact Form 7
- WPBakery Page Builder
- WooCommerce Stripe Payment Gateway
- LiteSpeed Cache
- WPForms
- The Events Calendar
- Duplicator
BuddyForms vulnerability stands out in the details section
Among the vulnerability details shown in the report, one issue is called out specifically: “BuddyForms <= 2.10.5 – Unauthenticated Privilege Escalation to Form-Type Confusion via ‘bf_post_type’ Parameter.” Wordfence assigns it a CVSS score of 9.8, placing it in the critical range.
The wording indicates a serious access-control problem, since the issue is unauthenticated and involves privilege escalation. Wordfence’s report does not add further technical exploitation details in the excerpt provided, but the score alone signals that affected site owners should treat it as urgent.
One theme was also affected
The weekly tally included a single WordPress theme: Soledad. Even though plugin vulnerabilities tend to dominate these reports, theme issues can still matter because themes often contain custom logic for rendering content, handling user input, or integrating with page builders and third-party services.
For site operators, the practical takeaway is simple: both plugins and themes need routine inventory checks, especially on sites that rely on premium or heavily customized products.
What Wordfence wants site owners to do
Wordfence says site owners running the Wordfence plugin with the scanner enabled should already have received alerts if their sites were affected by any of the newly added vulnerabilities. The company also points readers to its free Slack and HTTP webhook integrations for real-time notifications when new issues enter the database.
It is also promoting its mailing list for readers who want weekly reports and other WordPress security updates delivered directly to their inbox. For enterprises, hosting providers, and individual administrators, the broader message is that layered security depends on knowing what is vulnerable before attackers do.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More WordPress & CMS Tech News
Last Modified: November 12, 2026 at 10:33 pm
2 views
