Wordfence Intelligence Weekly Report Details 269 WordPress Vulnerabilities

Wordfence Intelligence has released its weekly vulnerability report, detailing a substantial number of security weaknesses discovered in WordPress plugins and themes between August 31 and September 6, 2026. The report cataloged a total of 269 vulnerabilities affecting 182 distinct WordPress plugins and 7 themes, underscoring the ongoing security challenges within the vast WordPress ecosystem.

The majority of these vulnerabilities were categorized by severity, with 179 classified as Medium and 73 as High. Sixteen vulnerabilities were rated Critical, and only one was deemed Low severity. This distribution highlights a concerning trend where a significant portion of disclosed flaws pose a considerable risk to websites running vulnerable plugins or themes.

Common vulnerability types identified include Cross-Site Scripting (XSS), with 88 instances, followed by Missing Authorization (52) and Authorization Bypass (19). Other notable CWEs (Common Weakness Enumerations) include Exposure of Sensitive Information to an Unauthorized Actor, SQL Injection, and Improper Privilege Management, indicating a broad range of potential attack vectors.

Of the 269 vulnerabilities, 247 have already been patched by vendors, offering a clear path to remediation for site owners. However, 22 vulnerabilities remain unpatched, posing an immediate threat to users who have not yet updated their software or whose vendors have not yet released fixes.

The Wordfence Threat Intelligence Team actively monitors these vulnerabilities and deploys real-time firewall rules to protect their Premium, Care, and Response customers. For the week in question, enhanced protection was rolled out for a specific vulnerability (WAF-RULE-956), with a 30-day delay for free Wordfence users.

Wordfence emphasizes its commitment to making vulnerability information accessible through its free Intelligence database, API, and CLI scanner, aiming to empower the WordPress community with the data needed for robust security practices. The report also acknowledges the contributions of 149 vulnerability researchers who identified and reported these flaws.

Site owners are strongly advised to review the disclosed vulnerabilities and ensure their WordPress installations, including all plugins and themes, are up-to-date. Prioritizing updates for components with unpatched vulnerabilities is crucial to mitigate the risk of exploitation.

This weekly report serves as a critical resource for the WordPress community, providing timely insights into emerging threats and reinforcing the importance of proactive security measures in maintaining website integrity.