Wordfence says 268 vulnerabilities were disclosed last week across 182 WordPress plugins and 15 WordPress themes, with 124 researchers contributing to the WordPress security ecosystem. The latest Wordfence Intelligence Weekly WordPress Vulnerability Report, covering October 19, 2026 to October 25, 2026, highlights a mix of patched and unpatched issues, including several critical flaws in widely used tools and themes.
Wordfence Intelligence Weekly WordPress Vulnerability Report: the main numbers
The report says 225 of last week’s vulnerabilities were patched, while 43 remained unpatched at the time of publication. By severity, Wordfence logged 6 low-severity issues, 186 medium-severity issues, 69 high-severity issues, and 7 critical issues. That distribution shows a familiar pattern for WordPress security: most disclosures are not headline-grabbing zero-days, but the volume still creates a meaningful patching burden for site owners.
Wordfence also broke the findings down by common weakness type. The most frequent categories were missing authorization, improper neutralization of input during web page generation, and deserialization of untrusted data. Those three classes alone accounted for a large share of the week’s disclosures, underscoring how often attackers can turn routine implementation mistakes into exploitable bugs.
Wordfence deployed firewall rules for a key UpdraftPlus issue
The Wordfence Threat Intelligence Team said it reviewed each vulnerability for impact, severity, and exploit likelihood before rolling out firewall protections. Last week, the team deployed enhanced rules for UpdraftPlus <= 1.26.11 – UDRPC key compromise.
Those protections were delivered immediately to Wordfence Premium, Care, and Response customers. Free users will receive the same enhanced protection after a 30-day delay.
Wordfence also repeated its standard guidance that users running the Wordfence plugin with the scanner enabled should already have been notified if their site was affected by a disclosed vulnerability. It additionally pointed readers to its Slack and HTTP webhook integration for real-time alerts.
Several critical bugs landed in popular plugins
Among the most serious disclosures were two critical flaws in Advanced Custom Fields: Extended and Advanced Custom Fields: Extended PRO. Wordfence listed both as CVSS 9.8 issues, each affecting version 0.9.2.7 and below, and both were marked patched.
- Advanced Custom Fields: Extended <= 0.9.2.7 – Unauthenticated Remote Code Execution, CVE-2026-94267, published Oct 23, 2026, researched by Jakub Herman.
- Advanced Custom Fields: Extended 0.9.2.7 – Unauthenticated Privilege Escalation via Account Takeover, CVE-2026-94268, published Oct 23, 2026, researched by Jakub Herman.
Other critical patched issues included Prime Mover <= 2.2.1, which Wordfence described as an unauthenticated PHP object injection issue tied to a base64-encoded comment during migration search-and-replace, and WP Mailster <= 1.9.1.0, listed as an unauthenticated arbitrary file upload. YOOtheme Pro also appeared with a critical arbitrary file upload issue affecting versions 5.0.0 through 5.0.52.
High-severity issues affected both plugins and themes
Many of the week’s most important findings were rated high rather than critical, but they still matter because several affected authenticated paths that can be dangerous in multi-user sites. One example is aBlocks <= 2.17.0, which Wordfence described as an authenticated Contributor+ privilege escalation issue involving the roleSlug block attribute. That vulnerability was patched and assigned CVE-2026-110018.
Wordfence also listed Classified Listing – AI-Powered Classified ads & Business Directory <= 6.1.5 as vulnerable to authenticated Subscriber+ arbitrary PHP code execution, and CM HIPAA Forms <= 3.3.1 as affected by authenticated privilege escalation. Duplicator and Duplicator Pro were both listed for unauthenticated PHP object injection, with the issue patched in the affected releases.
Another notable high-severity item was Royal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1068, which Wordfence classified as an authenticated Contributor+ remote code execution issue. The report credits Intrudify with that finding.
Unpatched issues were concentrated in themes and niche plugins
Not every disclosure had a fix available during the reporting window. Wordfence marked several findings as unpatched, including a cluster of theme vulnerabilities and a few plugin issues that administrators should watch closely.
- Academist Core <= 1.4.1 – Unauthenticated Local File Inclusion, CVE-2026-112820, unpatched.
- Hallelujah <= 1.1.1 – Unauthenticated PHP Object Injection, CVE-2026-112853, unpatched.
- Helion <= 1.1.12 – Unauthenticated PHP Object Injection, CVE-2026-112852, unpatched.
- Holistic Center <= 1.2.6 – Unauthenticated PHP Object Injection, CVE-2026-112854, unpatched.
- Hostme v2 – Responsive WordPress Theme <= 7.0 – Unauthenticated PHP Object Injection, CVE-2026-112848, unpatched.
- HotLock | Locksmith & Security Systems WordPress Theme + RTL <= 1.3.9 – Unauthenticated PHP Object Injection, CVE-2026-112851, unpatched.
- Participants Database <= 2.7.8.5 – Unauthenticated PHP Object Injection, CVE-2026-112862, unpatched.
- Redy <= 1.3.5 – Unauthenticated PHP Object Injection, CVE-2026-112855, unpatched.
- Reprizo – Jewelry & Watch Store Shopify Theme <= 1.0.8 – Unauthenticated PHP Object Injection, CVE-2026-112857, unpatched.
- Rhodos – Business Portfolio Elementor Blocks & Template Kit <= 1.3.3 – Unauthenticated PHP Object Injection, CVE-2026-112858, unpatched.
- Your Dress <= 1.4.1 – Unauthenticated Local File Inclusion, CVE-2026-112850, unpatched.
- ZenSoul <= 1.13 – Unauthenticated PHP Object Injection, CVE-2026-112847, unpatched.
These unpatched entries are a reminder that WordPress security is not just about updating immediately after a fix ships. For some products, especially smaller themes and niche plugins, site owners may need to decide quickly whether to disable the plugin, switch themes, or apply compensating controls while waiting for a release.
Why the weekly report matters for WordPress site owners
Wordfence positions Intelligence as a free vulnerability data service, with a user interface, API, and webhook integration that it says can be used both personally and commercially. The company says the database contains more than 40,000 vulnerabilities, and it encourages enterprises, hosting providers, and individual site owners to use the data for layered security and defense in depth.
That approach makes sense in a WordPress environment where plugin and theme sprawl can leave administrators blind to risk. The report gives a fast way to see which software families were hit last week, which are already patched, and where urgent attention is still required.
Wordfence also said 124 researchers contributed to WordPress security last week, a number that reflects how broad the disclosure ecosystem has become. The weekly leaderboard is more than a vanity metric; it is part of the disclosure pipeline that helps surface flaws before they are widely abused.
For site owners, the practical takeaway is simple: review installed plugins and themes against the week’s list, update any affected software, and keep monitoring for new alerts. When a vulnerability is unpatched, waiting is often the wrong strategy.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More WordPress & CMS Tech News
Last Modified: October 29, 2026 at 10:32 pm
1 views
