WordPress Vulnerabilities Drop 24% in Q2 as Attacks Surge
The latest WordPress security threat intelligence report from Wordfence covers the second quarter of 2026 and paints a mixed picture for site owners. While the total number of newly disclosed WordPress vulnerabilities fell by 24.3% compared with the first quarter to 2,073, the most dangerous flaws and real-world attack activity increased. Wordfence, which operates one of the largest WordPress-specific security networks, compiled the report from attack telemetry and vulnerability data gathered across millions of protected websites.
Vulnerability landscape: fewer disclosures, but more high-risk flaws
Wordfence added 2,073 vulnerabilities to its intelligence database during Q2 2026. The company was responsible for remediating and disclosing 47.4% of those vulnerabilities. Among them, 182 were classified as high threat vulnerabilities, meaning attackers are very likely to target them and they can lead to full site compromise with minimal effort. That number rose 15.2% from the previous quarter. Another 357 were common and dangerous vulnerabilities, a category that includes flaws frequently found in WordPress plugins and themes and still attractive to attackers looking for low-hanging fruit; that figure jumped 80.3% quarter over quarter. Wordfence disclosed 53.3% of the high threat vulnerabilities and 32.2% of the common and dangerous ones.
At the end of Q2, 149 reported vulnerabilities remained unpatched, which the report says highlights the value of a security scanner that warns site owners when an unpatched vulnerability is present so they can remove the affected software. Most disclosed vulnerabilities in Q2 required unauthenticated access to exploit, meaning an attacker does not need any user account on the site to launch an attack. This pattern was the same as Q1 2026. Plugins were the most commonly affected software type, as usual, with themes and WordPress core accounting for a smaller share.
The report lists the top 10 vulnerability classes for the quarter. Cross-site scripting (CWE-79), where attackers inject scripts into web pages viewed by others, was the most common with 600 cases. Missing authorization (CWE-862) followed with 416, then SQL injection (CWE-89) with 213, cross-site request forgery (CWE-352) with 121, deserialization of untrusted data (CWE-502) with 103, PHP remote file inclusion (CWE-98) with 101, exposure of sensitive information (CWE-200) with 87, authorization bypass through user-controlled key (CWE-639) with 85, path traversal (CWE-22) with 76, and unrestricted file upload (CWE-434) with 51.
Wordfence also tracks vendor engagement with its Vulnerability Management Portal. In Q2, 133 vendors signed up to manage their WordPress software security through the portal, a drop of 11.9% from the previous quarter, covering 412 distinct plugins and themes, down 25.6%. Vendors who register receive real-time alerts when a new vulnerability is discovered in their software.
Firewall and attack telemetry: exploit attempts grow
The Wordfence Web Application Firewall (WAF), which filters traffic to a WordPress site and blocks malicious requests, blocked or logged 10.4 billion exploit and probing requests in Q2, up 14.3% from Q1. The firewall released 16 new WAF rules during the quarter, down 27.3% from the previous quarter. In addition, 3.1 billion requests were blocked from the IP threat feed, a drop of 7.0%. The number of unique IP addresses involved in WAF attacks reached 19.7 million, up 16.7%, and unique IPs drawn from the Wordfence blocklist rose 58.9% to 353,000. Unique user agents, which are the identifying strings sent by browsers and bots, climbed 263.7% to 72.9 million.
The top 10 user agents engaged in exploiting vulnerabilities are listed with request counts. The most active was a mobile Safari user agent string, often associated with automated traffic, which generated 1,329,501,815 requests. That was followed by Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.6312.86 with 723,929,095, curl/8.7.1 with 532,032,669, Chrome 120.0.0.0 with 408,187,867, Chrome 126.0.0.0 with 310,476,820, Chrome 131.0.0.0 with 178,527,122, the same mobile Safari string again with 150,640,717, Chrome 123.0.6312.86 repeated with 136,301,524, generic Mozilla with 121,666,197, and Chrome 133.0.0.0 with 113,914,440.
The report also names the top 10 unique vulnerabilities targeted by attackers, ranked by blocked requests. The LiteSpeed Cache plugin vulnerability (unauthenticated privilege escalation in versions up to 6.3.0.1) was by far the most targeted, with 49,711,496 blocked requests. Next were WPGraphQL (up to 0.2.3) with 29,403,849, N-Media Post Front-end Form (before 1.1) with 23,130,942, WooCommerce Payments (4.8.0 to 5.6.1) with 12,610,278, SureTriggers (up to 1.0.78) with 10,602,932, Ninja Forms (up to 3.5.7) with 9,975,128, Rank Math SEO (up to 1.0.40.2) with 7,110,040, POST SMTP Mailer (up to 2.8.7) with 4,890,917, Discount Rules for WooCommerce (up to 2.0.2) with 3,797,139, and Envato Elements (up to 2.0.10) with Template Kit (up to 1.0.13) at 1,742,988. The most active attacking IP address, 45.88.138.44, sent 134,891,593 requests.
Password attacks: brute force remains a major threat
Wordfence blocked 18.2 billion brute force attacks in Q2, an increase of 13.8% from the previous quarter. A brute force attack is an automated attempt to guess passwords by trying many combinations. The number of unique IP addresses involved in these password attacks jumped 55.9% to 106.2 million, while the average number of requests per IP dropped 27.0% to 171. The report notes that the largest attack volumes come from botnets, but the geographic distribution charts are shown for top countries. Wordfence's free plugin includes features to block known compromised passwords and limit login attempts.
Malware intelligence: infected sites rise
Wordfence's malware signatures detected 573,000 distinct sites with malware in Q2, a 21.0% increase over Q1. The total count of unique malware files reached 31.6 million, up 15.2%. Wordfence released 85 new malware signatures during the quarter, a decline of 4.5% from the previous quarter. On average, an infected site had 49.3 infected files (down 4.8%) and 2.2 malware variations per site (down 7.8%). PHP files were the most commonly detected malware type; the report notes that PHP files are often associated with webshells, backdoors, infostealers, and card skimmers, while JavaScript and HTML files are more often linked to spam.