Wordfence Intelligence says the WordPress ecosystem saw another heavy week of vulnerability disclosures, with 549 vulnerabilities added to its database across 351 plugins and four themes between October 26, 2026 and November 1, 2026. The weekly report also credits 222…
Attackers are already probing a newly patched WordPress core flaw that can allow unauthenticated remote code execution during a site upgrade, according to Wordfence. The issue, tracked as CVE-2026-119977, affects WordPress versions 4.7 through 7.1.3 and was addressed in WordPress…
Google’s CVE-2026-111497 has put Brotli back in the spotlight after a critical decoder bug was disclosed and fixed in late October 2026. Although the flaw is not in WordPress itself, Wordfence says the vulnerability can be reached through a WordPress…
WordPress 7.1.4, released on October 28, 2026, closes a serious unauthenticated remote code execution flaw in the Core update process, and security researchers say attackers were already trying to exploit it within hours of the patch going live. The issue…
Wordfence says 268 vulnerabilities were disclosed last week across 182 WordPress plugins and 15 WordPress themes, with 124 researchers contributing to the WordPress security ecosystem. The latest Wordfence Intelligence Weekly WordPress Vulnerability Report, covering October 19, 2026 to October 25,…
Scanfully 2.0 is pushing WordPress site monitoring toward something closer to an understandable operations dashboard than a pile of raw alerts. In a WP Tavern podcast conversation, co-founder Remkus de Vries explained how the service is trying to make security,…
Wordfence Intelligence’s latest weekly WordPress vulnerability report shows another heavy seven-day stretch for the ecosystem: 497 vulnerabilities disclosed across 327 plugins and 23 themes between October 12, 2026 and October 18, 2026. Wordfence says 218 vulnerability researchers contributed to WordPress…
WordPress security firm Wordfence says attackers used compromised UpdraftCentral connection keys to push malicious plugins onto connected sites after TeamUpdraft disclosed unauthorized access to its website over the October 17-18, 2026 weekend. The incident affects sites that were linked to…
Wordfence Intelligence’s latest weekly WordPress vulnerability report shows a busy seven days for the ecosystem, with 655 vulnerabilities disclosed across 406 plugins and 100 themes between October 5, 2026 and October 11, 2026. Wordfence says 236 vulnerability researchers contributed to…
A high-severity SQL injection flaw in the Backuply WordPress plugin could let authenticated attackers with subscriber-level access turn a routine backup restore into a full site takeover. Wordfence says the issue affects versions up to and including 1.5.8, with a…
WordPress security in 2026 looks less like a single technical problem and more like a mix of preparedness, user behavior, and a rapidly shifting threat landscape shaped by AI. In a new WP Tavern podcast episode, Melapress founder Robert Abela…
Wordfence Intelligence’s latest weekly WordPress vulnerability report says 501 vulnerabilities were disclosed last week across 367 plugins and 9 themes, with 201 vulnerability researchers contributing to WordPress security. The report, covering September 28, 2026 to October 4, 2026, also notes…
Wordfence’s Quarterly WordPress Threat Intelligence Report – Q2 2026 shows another busy three months for the WordPress ecosystem, with billions of blocked attacks, a rise in high-threat vulnerabilities, and a continued climb in malware infections across protected sites. While the…
Cloudflare has outlined how it moved its main blog from WordPress to EmDash, the open source content management system it built internally, and the company says the switch delivered a faster, more reliable reading experience. The migration is notable not…
Wordfence Intelligence’s weekly WordPress vulnerability report for September 14 to September 20, 2026, shows another busy week for the ecosystem: 358 vulnerabilities were disclosed across 243 plugins and four themes, with 184 researchers contributing to WordPress security. The latest data…
WordPress has shipped an urgent security update after the discovery of CVE-2026-87902, a critical unauthenticated path traversal flaw in WordPress Core that can, under the right conditions, lead to remote code execution. The WordPress Security Team released WordPress 7.1.2 on…
A Wordfence threat-intelligence analysis has exposed a malicious WordPress must-use plugin that is built to stay hidden, resist removal, and keep its foothold even after cleanup attempts. The malware uses self-healing routines, account abuse, dashboard hiding tricks, and EtherHiding —…
Wordfence Intelligence’s weekly WordPress vulnerability report for September 7 to September 13, 2026 shows another busy seven days for the ecosystem, with 260 vulnerabilities disclosed across 207 WordPress plugins and 147 researchers contributing findings. The latest report highlights a mix…
Wordfence says a newly disclosed vulnerability in Tutor LMS, a WordPress e-learning plugin active on more than 100,000 websites, could let authenticated attackers with subscriber-level access reach remote code execution on the server. The issue, tracked as CVE-2026-78175 and rated…
Attackers are actively exploiting a critical vulnerability in the WooCommerce Wholesale Lead Capture plugin for WordPress, with Wordfence saying it has already blocked more than 100,000 exploit attempts. The flaw, tracked as CVE-2026-27540, can let unauthenticated attackers upload arbitrary files,…
Hashe Computer Solutions (Pvt) Ltd. was established in 1998 and is a global consulting and IT services company. Hashe provides expert analysts and development teams, who translate corporate strategies into creative, robust, and cost-effective systems that leverage a client's unique competitive advantage resulting in shorter time-to-market cycles. We also offer complete outsourcing solutions from software development to after development mission-critical-level support.
225 Cavalry Grounds, Street 5,
Lahore 54810, Pakistan.
Director & CEO