WordPress vulnerabilities leave 43 flaws unpatched
WordPress vulnerabilities disclosed from October 19 to October 25, 2026 affected 182 plugins and 15 themes, according to Wordfence Intelligence. Its database added 268 vulnerabilities during the week, including 43 that remained unpatched when recorded. The other 225 were listed as patched. Wordfence attributed the disclosures to 124 contributing vulnerability researchers.
Severity was concentrated in the middle and upper ranges: seven vulnerabilities were critical, 69 high severity, 186 medium severity and six low severity. These ratings use the Common Vulnerability Scoring System (CVSS), a standard scale for estimating the technical seriousness of a security flaw. A CVE, or Common Vulnerabilities and Exposures identifier, gives a publicly documented flaw a unique reference number. A high score does not by itself confirm that attackers exploited a vulnerability, and Wordfence did not report confirmed exploitation for the flaws highlighted here.
The seven critical WordPress vulnerabilities all had patches available. Advanced Custom Fields: Extended and its Pro edition were affected by unauthenticated remote code execution through version 0.9.2.7 (CVE-2026-94267), meaning an attacker would not need to log in before attempting to run code. Version 0.9.2.7 also had an unauthenticated account-takeover privilege escalation flaw (CVE-2026-94268). The free edition through 0.9.2.7 was separately affected by unauthenticated arbitrary file deletion (CVE-2026-112311). All three were rated critical, with the first two scoring 9.8 and the deletion issue scoring 9.1.
The remaining critical findings were Prime Mover through 2.2.1, with unauthenticated PHP object injection during migration search and replace of a Base64-encoded comment (CVE-2026-115806); WP Mailster through 1.9.1.0, with unauthenticated arbitrary file upload (CVE-2026-111832); YOOtheme Pro versions 5.0.0 through 5.0.52, also with unauthenticated arbitrary file upload (CVE-2026-102785); and weForms through 1.6.28, with unauthenticated arbitrary file deletion (CVE-2026-111833). Each scored 9.8 except the weForms issue, which scored 9.1. PHP object injection occurs when unsafe data is turned back into a software object, potentially triggering unintended application behaviour.
Among the 69 high-severity findings, patched examples included unauthenticated PHP object injection in Duplicator through 1.5.17 and Duplicator Pro through 4.6.10 (CVE-2026-82814), SQL injection in Ajax Search Lite through 4.14.6 (CVE-2026-111852), and authentication bypass in Royal MCP before 1.5.7 (CVE-2026-111958). SQL injection is the use of crafted input to manipulate a website's database commands. Other patched high-severity cases included remote code execution in Royal Addons for Elementor through 1.7.1068, arbitrary PHP code execution in Classified Listing through 6.1.5, and two stored cross-site scripting flaws in LiteSpeed Cache before 7.9.2. Stored cross-site scripting places hostile browser code in content that is later shown to visitors or administrators.
Several high-severity products were still unpatched. Wordfence listed unauthenticated local file inclusion in Academist Core through 1.4.1 and Your Dress through 1.4.1. Participants Database through 2.7.8.5 had separate unauthenticated PHP object injection and SQL injection findings. EventON Subscriber through 1.4.5 had unauthenticated SQL injection through its email parameter. Unpatched PHP object injection also affected the Hallelujah, Helion, Holistic Center, Hostme v2, HotLock, Little Birdies, Redy, Reprizo, Rhodos, Save Life, Vagabonds and ZenSoul products in the specified affected versions. Hostme v2 through 7.0 and KALLYAS through 4.25.0 additionally had unpatched stored cross-site scripting findings.
The most common weakness category was missing authorization, with 75 findings. Improper neutralization of input during web-page generation accounted for 69, followed by deserialization of untrusted data with 20, authorization bypass through a user-controlled key with 16, and improper handling of special elements in SQL commands with 13. Client-side enforcement of server-side security appeared 11 times, sensitive information exposure 10 times, and improper privilege management eight times. The remaining categories included improper control of code generation (seven), improper authentication (six), cross-site request forgery (five), incorrect authorization (five), insufficient verification of data authenticity (five), PHP include or require filename control (four), path restriction failures (four), dangerous file uploads (four), improper input validation (two), and one case each of guessable CAPTCHA, improper authorization, improper link resolution and uncontrolled resource consumption.
Wordfence also deployed a firewall rule for an UpdraftPlus issue affecting versions through 1.26.11 and described as a UDRPC key compromise. A web application firewall filters requests before they reach vulnerable website code. Wordfence Premium, Care and Response customers received the rule immediately, while the free plugin was scheduled to receive it after a 30-day delay. A firewall rule is an additional defensive layer, not a substitute for installing a vendor's security update.
Wordfence says its scanner should notify sites running the plugin with scanning enabled when installed software matches a database entry. Its vulnerability interface, application programming interface (API) and webhook integration are available without charge for personal and commercial use. The API can provide a copy of a database containing more than 40,000 vulnerabilities, while webhooks can send updates when entries are added or changed. A webhook is an automatic message sent from one service to another when an event occurs.
Site owners should compare installed plugin and theme versions with the affected ranges, apply available updates and remove software that is no longer needed. For an unpatched component, disabling and replacing it is safer than leaving it exposed, particularly when the flaw needs no login. Before updating or removing important site software, create a restorable backup and test changes where possible. For readers that want the hosting layer handled as a service, AEU Hosting provides managed WordPress hosting secured end to end.
The volume of disclosures also shows why checking only WordPress core is insufficient. Plugins and themes expand what a site can do, but each installed component adds code that must be tracked, updated and, when a patch is unavailable, disabled or replaced promptly.