WordPress News & Coverage
Wordfence Intelligence reports 75 new WordPress vulnerabilities disclosed in plugins and themes during May 4–10, 2026, with critical flaws prompting immediate firewall updates.
Wordfence researchers uncovered a critical authentication bypass in the Burst Statistics plugin impacting over 200,000 WordPress sites. Immediate updates to version 3.4.2 are essential to prevent administrator impersonation.
The Avada Builder WordPress plugin with 1 million active sites has critical Arbitrary File Read and SQL Injection vulnerabilities. Immediate patching is essential.
The latest Wordfence Intelligence report reveals 87 WordPress vulnerabilities disclosed last week, with critical patches and new firewall rules deployed to protect sites.
An authenticated arbitrary file upload vulnerability affecting Slider Revolution 7.0.0 to 7.0.10 has been patched in version 7.0.11. This flaw allowed subscriber-level users to achieve remote code execution.
A critical Arbitrary File Upload vulnerability in Breeze Cache plugin is actively exploited, risking remote code execution on 400,000 WordPress sites. Immediate update to version 2.4.5 is vital.
Wordfence Intelligence reports 157 new WordPress vulnerabilities last week, with 42 unpatched including 6 critical. New firewall rules deployed to protect premium users in real time.
Wordfence reports 139 new WordPress vulnerabilities last week across plugins and themes, with 109 patched and 30 unpatched. Cross-site scripting and authorization flaws dominate.
154 vulnerabilities were disclosed last week across 118 plugins and 23 themes. Wordfence tools help users monitor and patch risks effectively.
A critical vulnerability in Ninja Forms – File Upload plugin is actively exploited, affecting 50,000 WordPress sites. Update to version 3.3.27 immediately.
