Wordfence’s latest weekly report shows another busy seven days for the WordPress ecosystem: 246 vulnerabilities were disclosed across 174 plugins and five themes added to the Wordfence Intelligence Vulnerability Database between August 24 and August 30, 2026. Of those, 234…
Wordfence says its Argus research system uncovered a high-severity unauthenticated arbitrary file upload flaw in the popular Gravity Forms WordPress plugin, affecting versions 3.0.2 and earlier and potentially allowing remote code execution on some server setups. The company disclosed the…
Attackers are actively exploiting a critical vulnerability in the Super Forms WordPress plugin, and Wordfence says its firewall has already blocked more than 250,000 attempts. The flaw affects versions 6.3.313 and earlier, can be abused without authentication, and may let…
Aaron D. Campbell says WordPress security is entering a faster, more complicated era, driven in large part by AI. In a WP Tavern Jukebox Podcast episode recorded at WordCamp US, Campbell described how attackers and defenders are now locked in…
Attackers are actively exploiting a critical Elementor Pro vulnerability that can let unauthenticated users upload arbitrary files, including PHP payloads that may lead to remote code execution and full site takeover. Wordfence says its firewall has already blocked more than…
A high-severity SQL injection vulnerability in the All-in-One WP Migration and Backup WordPress plugin affects versions up to 7.109 and could let unauthenticated attackers reach remote code execution under the right conditions, according to Wordfence. The plugin has more than…
Wordfence Intelligence’s weekly WordPress vulnerability report for August 17 to August 23, 2026 shows another heavy seven days for the ecosystem: 240 vulnerabilities were disclosed across 184 plugins and 17 themes added to the database, with 105 researchers contributing findings….
Wordfence says its Argus research tool uncovered a critical authentication bypass in the WPMU DEV Dashboard WordPress plugin, a flaw that could let unauthenticated attackers reach administrator access on sites using Hub Single-Sign On. The issue affects versions up to…
TranslatePress, a WordPress plugin with more than 400,000 active installations, has been found vulnerable to an unauthenticated account takeover flaw that can expose an administrator’s password reset link and lead to full site compromise. Wordfence says the issue affects versions…
Wordfence Intelligence’s weekly WordPress vulnerability report for August 10 to August 16, 2026 shows another heavy seven-day stretch for the ecosystem, with 259 vulnerabilities disclosed across 199 plugins and five themes. Of those issues, 204 were already patched and 55…
Wordfence says a critical arbitrary file upload flaw in Elementor Pro, a WordPress plugin with an estimated 6 million active installations, could let unauthenticated attackers upload executable PHP files and potentially take over a site. The issue, tracked as CVE-2026-32475…
Wordfence Intelligence says 247 WordPress vulnerabilities were disclosed last week across 195 plugins and two themes, with 135 researchers contributing new findings to the database between August 3, 2026 and August 9, 2026. The weekly report highlights a mix of…
Wordfence says a critical authentication bypass in the User Profile Builder WordPress plugin could let unauthenticated attackers log in as a site’s administrator on affected installations, putting more than 40,000 active sites at risk. The issue affects versions up to…
Wordfence Intelligence’s weekly WordPress vulnerability report for July 13 to July 19, 2026 logged another busy week for the ecosystem, with 75 vulnerabilities disclosed in WordPress Core, 68 in plugins and none in themes. Of the 75 issues added to…
Wordfence Intelligence’s weekly WordPress vulnerability report for July 20 through July 26, 2026 shows another heavy stretch for the ecosystem, with 223 vulnerabilities disclosed across 175 plugins and 6 themes. Wordfence says 88 researchers contributed findings during the week, while…
Wordfence Intelligence says 224 WordPress vulnerabilities were disclosed last week across 177 plugins and two themes, with 119 researchers contributing to the database between July 27, 2026 and August 2, 2026. The weekly report highlights a mix of patched and…
WordPress has patched a critical unauthenticated remote code execution chain in core that security researchers say is the first of its kind in nearly a decade. The issue, widely referred to as wp2shell, combines two flaws that can be chained…
The WordPress Security Team has released core updates that patch a vulnerability chain capable of escalating from unauthenticated SQL injection to unauthenticated remote code execution. The fixes, issued on July 17, 2026, apply to WordPress core versions in the 6.8.x,…
At WordCamp Europe, developer Milan Petrović used his WP Tavern podcast appearance to make a simple but urgent case: if your WordPress site, plugin stack, or hosting setup is still tied to legacy PHP, you are carrying avoidable security and…
AI is changing how WordPress security researchers work, and in Austin Ginder’s case, it helped uncover a troubling pattern in plugin supply chain attacks. In a recent WP Tavern podcast episode, Ginder explained how malware cleanups on customer sites led…
Hashe Computer Solutions (Pvt) Ltd. was established in 1998 and is a global consulting and IT services company. Hashe provides expert analysts and development teams, who translate corporate strategies into creative, robust, and cost-effective systems that leverage a client's unique competitive advantage resulting in shorter time-to-market cycles. We also offer complete outsourcing solutions from software development to after development mission-critical-level support.
225 Cavalry Grounds, Street 5,
Lahore 54810, Pakistan.
Director & CEO