WordPress vulnerabilities include critical core RCE chain
WordPress vulnerabilities submitted to the Wordfence Bug Bounty Program reached 1,077 in July 2026, up 1.0% from the previous month. Wordfence says its Threat Intelligence team reviews and validates reports, coordinates disclosure with affected vendors, verifies patches and creates firewall coverage where appropriate. Vendors can manage reports through its free Vulnerability Management Portal. A bug bounty program pays security researchers for responsibly reporting flaws so developers can fix them before attackers exploit them.
The program had 281 active researchers, down 8.2% month over month. Reports included 84 high-threat findings, an increase of 44.8%, and 73 classified as common and dangerous, up 62.2%. Wordfence released 15 web application firewall rules, up 114.3%. A web application firewall, or WAF, examines website requests and blocks traffic matching known attack patterns. Wordfence defines high-threat findings as issues such as arbitrary file upload or remote code execution that an unauthenticated or low-privilege attacker can exploit in software with at least 25 active installations. Its common-and-dangerous category covers stored cross-site scripting and SQL injection under similar access conditions in software with at least 500 installations.
Of the month’s submissions, 243 were accepted as in scope, 17 were outside the program’s scope, 610 were rejected and 207 were duplicates. Wordfence awarded $51,183 in bounties, averaging $210.63 for each validated, in-scope report. The highest individual award was $15,600. Wordfence says Premium, Care and Response customers receive applicable firewall protection in real time, while rules reach free users after 30 days.
The largest bounty concerned Elementor Pro through version 4.2.1, where an unauthenticated attacker could bypass upload-field array validation and upload an arbitrary file. The affected software was listed with 5,000,000 installations. Forminator Forms through 1.56.1 received a $2,048 bounty for an unauthenticated arbitrary file upload using a forged upload-field configuration, with 600,000 installations. User Profile Builder through 3.16.4 had an unauthenticated authentication bypass involving type confusion in the `username` parameter that could lead to administrator account takeover; the bounty was $975 and the listed installation count was 40,000. Independent Analytics through 2.15.0 received an $804 bounty for unauthenticated stored cross-site scripting, affecting software listed with 100,000 installations. Unlimited Elements For Elementor through 2.0.16 received $800 for unauthenticated SQL injection and was listed with 300,000 installations.
Stored cross-site scripting allows hostile code to be saved by a website and delivered to later visitors. SQL injection manipulates a site’s database commands through unsafe input. Among accepted reports, the most common category was CWE 79, improper handling of input during page generation, with 80 submissions, $13,415 in total rewards and a $167.69 average. CWE 434, dangerous unrestricted file upload, had 18 reports but led total rewards at $21,909, averaging $1,217.17. CWE 89 SQL-related flaws also had 18 reports and paid $2,968. Other categories included improper privilege management with 16 reports, pathname restriction flaws with 10, improper authentication with 11, user-controlled authorization bypass with nine, missing authorization with nine, unsafe code generation with three and alternate-path authentication bypass with two. Single reports involving incorrect type conversion and deserialization of untrusted data received $975 and $615 respectively.
Access requirements strongly shaped the reported risk. Wordfence listed 163 unauthenticated vulnerabilities with an average reward of $350.84, 60 subscriber-level flaws averaging $133.37, 14 unauthenticated findings requiring user-interface interaction averaging $74, and four custom-access cases averaging $19.67. Installation data also varied widely. The 31 findings in software distributed outside the official repository averaged a 9.0 CVSS score and an $871.60 reward. CVSS, the Common Vulnerability Scoring System, rates technical severity on a numerical scale. The 81 findings in software with 1,000 to 49,999 installations averaged 7.4 and $147.53, while 38 findings in the 100,000 to 999,999 range averaged 7.0 and $384.87. Only one finding appeared in the 1,000,000 to 4,999,999 range, with a 7.2 score and a $672 reward.
The most consequential WordPress Core issue was the wp2shell chain. Wordfence reported that WordPress Core versions 6.9 through 7.0.1 were vulnerable to remote code execution, or RCE, through the REST API batch endpoint at `/wp-json/batch/v1`. RCE means an attacker can make the server run commands or code without being physically present. The REST API is an interface that lets software exchange requests with WordPress. A mismatch between route validation and dispatch could let a validated sub-request reach an unintended callback, bypass the `allow_batch` restriction and avoid the target route’s input cleaning. The weakness could then be combined with SQL injection to execute code on the server.
The WordPress Security Team released patched versions 6.8.6, 6.9.5 and 7.0.2 on July 17, 2026. Its release notes classified the two flaws used in the wp2shell chain as one critical issue and one high-severity issue. Forced automatic updates were enabled for affected versions because of the severity. Wordfence described the chain as the first critical unauthenticated WordPress Core RCE in nearly a decade and attributed its discovery and responsible disclosure to Assetnote and Searchlight Cyber.
A separate case affected Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick … versions 10.8.7 and 10.8.8. Wordfence PRISM identified a hardcoded backdoor that could let an unauthenticated attacker take control of a selected existing administrator account. The `_arve_uc_init()` function ran on every request before authentication checks, accepted a token through the `_wplogin` or `_wpm` parameter and compared it with a SHA-256 hash embedded in the plugin. The process had no nonce verification, capability check or password validation. A nonce is a one-use value intended to prove that a request came from an expected page or session. Because the universal credential was exposed in the plugin’s code, anyone knowing the token could use it. Wordfence said the backdoor was likely introduced after an attacker gained commit access to the developer’s account, but presented that origin as a likelihood rather than a confirmed fact.
No bounty promotions were running during the reporting period, and no researchers advanced to the Elite or Resourceful tiers. For site owners, the practical lesson is to install WordPress security releases promptly, update or disable affected plugins and maintain recoverable backups before making changes.