Wordfence Intelligence’s latest weekly WordPress vulnerability report shows another heavy seven-day stretch for the ecosystem: 497 vulnerabilities disclosed across 327 plugins and 23 themes between October 12, 2026 and October 18, 2026. Wordfence says 218 vulnerability researchers contributed to WordPress security last week, while its team also rolled out new firewall protections for selected issues in real time.
What the Wordfence Intelligence weekly report says
The report is designed as a snapshot of the latest security disclosures collected into the Wordfence Intelligence Vulnerability Database. Wordfence says the goal is to make vulnerability information easy to access for the WordPress community so site owners, hosting providers, and security teams can act quickly and layer their defenses.
According to the company, the database now contains more than 40,000 vulnerabilities. Wordfence says its user interface, vulnerability API, and webhook integration are free to use both personally and commercially, and that enterprise customers, hosting providers, and individuals can pull the full database or monitor new entries in real time.
Wordfence also uses the weekly report to encourage readers to subscribe to its mailing list for future updates and WordPress security reports.
New firewall rules deployed in real time
In addition to cataloging newly disclosed bugs, the Wordfence Threat Intelligence Team reviews vulnerabilities to assess impact, severity, and the likelihood of exploitation. Based on that review, Wordfence says it deployed enhanced firewall protection last week for the following issues:
- WAF-RULE-966 – Data redacted while Wordfence works with the vendor on a patch.
- WAF-RULE-967 – Data redacted while Wordfence works with the vendor on a patch.
- PHP Object Injection in Comments
Wordfence says Premium, Care, and Response customers received the protection immediately. Users on the free version of Wordfence will receive the same firewall coverage after a 30-day delay.
Patched versus unpatched vulnerabilities
The weekly totals show that most vulnerabilities disclosed last week were already patched, but a sizable portion remained unpatched at the time of reporting.
- Patched: 428
- Unpatched: 69
That split matters for site operators because unpatched disclosures can represent a wider exposure window, especially for popular plugins or themes with large installed bases. Even when a fix exists, delayed updates can leave sites vulnerable until the patch is applied.
Severity trends point to a busy but mixed-risk week
Wordfence classified last week’s disclosures across the usual CVSS severity bands. The largest share landed in the medium category, but the report also includes a notable number of high and critical issues.
- Low severity: 6
- Medium severity: 315
- High severity: 153
- Critical severity: 23
In practice, that means site owners should not focus only on the headline number of vulnerabilities. A smaller set of severe flaws can be just as important as a much larger volume of lower-risk disclosures, especially if they affect authentication, file uploads, or privilege boundaries.
Common vulnerability patterns in the report
The vulnerability types listed in the report reflect familiar WordPress security themes. Cross-site scripting and missing authorization were the most common categories, followed by SQL injection and deserialization issues.
- Cross-site scripting: 159
- Missing authorization: 116
- SQL injection: 34
- Deserialization of untrusted data: 33
- Exposure of sensitive information to an unauthorized actor: 31
- Improper privilege management: 22
- Authorization bypass through user-controlled key: 20
- Code injection: 15
- Unrestricted upload of file with dangerous type: 11
- Path traversal: 10
Other categories in the report include CSRF, improper authentication, remote file inclusion, SSRF, open redirects, and several lower-frequency flaws such as race conditions, embedded malicious code, and command injection.
Researchers contributing to WordPress security
Wordfence credited 218 researchers for last week’s disclosures, underscoring how much of the WordPress security ecosystem depends on independent researchers and coordinated reporting. The weekly leaderboard was led by Wordfence PRISM with 40 vulnerabilities, followed by johska with 19, Peter Tang with 16, Kuba with 15, and Jacek Sowiński (dzaku) with 13.
Other notable contributors included Ananda Dhakal with 11, nh4tvd and AndrewN with 10 each, Naoki Kawahigashi with 9, and a group of researchers who reported eight or more issues. The report also lists a long tail of contributors with smaller numbers of disclosures, reflecting a broad and active research community.
Wordfence says researchers who responsibly disclose vulnerabilities may be added to the Wordfence Intelligence leaderboard and may also be eligible for bounty payments through its Bug Bounty Program for in-scope findings.
What stands out for WordPress site owners
The report does not single out a single dominant plugin or theme as the top risk, but the breadth of affected software is itself the headline. Wordfence lists vulnerabilities across a wide range of plugins spanning forms, page builders, booking tools, e-commerce extensions, SEO tools, security products, and media libraries.
That breadth is a reminder that WordPress risk is rarely confined to core software alone. Popular add-ons often expand functionality quickly, but they also widen the attack surface, particularly when they handle user input, account permissions, file uploads, or custom integrations.
For site owners, the practical takeaway is straightforward:
- Audit installed plugins and themes regularly.
- Apply updates quickly, especially for unpatched or high-severity issues.
- Remove extensions that are no longer needed.
- Review whether any critical business tools depend on third-party plugins with a history of frequent disclosures.
- Use a defense-in-depth approach rather than relying on updates alone.
Wordfence’s weekly report is less about a single emergency and more about the scale of ongoing maintenance required to keep WordPress environments secure. With 497 vulnerabilities added in one week, even well-managed sites can accumulate risk quickly if patching falls behind.
Source: Original report
Was this helpful?
Explore more: WordPress Troubleshooting More WordPress & CMS Tech News
Last Modified: October 24, 2026 at 10:32 pm
2 views
