WordPress: 52 of 501 disclosed flaws remain unpatched
WordPress security disclosures totalled 501 vulnerabilities, with 52 still unpatched, in Wordfence Intelligence's report covering September 28 to October 4, 2026. Wordfence says the findings affected 367 plugins, the add-ons that extend a site's functions, and nine themes, which control its presentation. The figures describe disclosed software weaknesses, not a count of compromised websites.
Wordfence added the findings to its Intelligence Vulnerability Database and credited 201 security researchers with contributions during the reporting period. Its patch-status breakdown lists 449 vulnerabilities as patched, meaning a software correction was available, and 52 as unpatched. A fix being available does not mean it has been installed on every affected site. Equally, a product appearing in the report does not establish that every version of it is vulnerable.
The severity breakdown includes 20 critical and 174 high-severity vulnerabilities, alongside 306 medium-severity findings and one low-severity finding. Those categories use CVSS, the Common Vulnerability Scoring System, a standard way to assess the seriousness of software weaknesses. Severity helps owners prioritise checks, but the affected version and the conditions needed to exploit a flaw remain important. The supplied report excerpt does not provide those details for individual products, so it cannot establish whether a particular installation is exposed.
Cross-site scripting, where unsafe input can become browser-executed code on a website, was the largest category with 206 findings. Missing authorization, a failure to check whether someone has permission to perform an action, accounted for 68. SQL injection, where crafted input alters commands sent to a database, accounted for 42. Wordfence also counted 34 cases of sensitive information being exposed to an unauthorized party and 30 cases of deserialization of untrusted data, where software reconstructs stored data supplied by an untrusted source in an unsafe way.
The report groups weaknesses using CWE, or Common Weakness Enumeration, a shared classification of software security mistakes. Further categories included 23 authorization bypasses through a user-controlled key, meaning a changeable input could defeat a permission check; 14 code-injection weaknesses, where input can become executable instructions; and 13 path-traversal weaknesses, where a file request can escape its intended folder. Another 13 involved improper privilege management, or incorrectly assigned powers within the software.
Nine findings involved enforcing security in the browser instead of on the server, and eight involved improper authentication, the process of checking identity. Seven were cross-site request forgery, where a user can be tricked into submitting an unwanted website action. Five allowed unrestricted uploads of dangerous file types. Four involved server-side request forgery, where a site can be induced to make unintended network requests, and four involved uncontrolled resource consumption, which can exhaust available computing capacity.
Smaller categories included three findings each involving externally controlled filenames or paths, unsafe inclusion of remote files in PHP (the programming language WordPress uses), and redirects to untrusted sites. Two involved improper input validation, meaning inadequate checks on incoming data. Single findings covered a race condition, where overlapping operations interact unsafely; a guessable CAPTCHA, the challenge intended to distinguish people from automated activity; improper authorization; incorrect authorization; general injection; operating-system command injection; insufficiently protected credentials; another path-traversal category; protection mechanism failure; and a hard-coded password embedded in software.
The visible product list spans commerce, forms, site building, backups, search and performance. Examples include Autoptimize, Cache Enabler, EWWW Image Optimizer, All in One SEO, Beaver Builder Page Builder, CMB2, Download Monitor, EmbedPress, Essential Addons for Elementor, Event Tickets and Registration, Fluent Forms, Forminator Forms, Groundhogg, hCaptcha for WP, JetEngine, JetFormBuilder, Kadence Blocks and LearnPress. It also names BackupEase, BackupSheep WordPress Backup Plugin, Hostinger Migrator and Hostinger Reach. Check the individual advisory rather than assuming a product name identifies an affected version. The supplied text stops partway through the plugin list and does not include the names of the nine themes.
Wordfence's Threat Intelligence Team says it reviews vulnerabilities for impact, severity and likelihood of exploitation when assessing firewall coverage. A firewall filters incoming requests to help block malicious traffic. For this period, Wordfence listed enhanced protection under WAF-RULE-963 but withheld the vulnerability details while working with the vendor on a patch. The affected product and technical details therefore remain undisclosed in the supplied text. Wordfence Premium, Care and Response customers received the rule immediately; users of the free version receive that enhanced protection after a 30-day delay. That rule announcement is not evidence of coverage for every flaw in the report.
Among the credited contributors, Ananda Dhakal was listed with 72 vulnerabilities, Intrudify with 19, Jakub Herman with 14, nh4tvd and neurotx with 12 each, Artus KG with 10, and Kuba and Rafie Muhammad with nine each. Wordfence PRISM was among the contributors credited with seven. Wordfence invites researchers to disclose findings responsibly through its Bug Bounty Program, which offers rewards for eligible vulnerabilities, with recognition in its Intelligence leaderboard and weekly reporting.
Wordfence says its database interface, API and webhook integration are free for personal and commercial use. An API is a way for software to exchange information; a webhook sends an automated notification when something changes. Enterprises, hosting providers and individuals can obtain a complete database export containing more than 40,000 vulnerabilities and use notifications to follow new entries and updates in real time. Wordfence also offers email subscriptions for its weekly vulnerability and other WordPress security reports. It presents these resources as support for layered security, using several safeguards rather than relying on one.
For site owners, the immediate task is to compare installed plugins and themes with the detailed database records, confirm affected versions and apply available fixes. Back up before changes and check essential functions afterwards. If an installed component has an unpatched vulnerability, ask its developer or a trusted support provider whether it should be disabled or replaced.