Wordfence Intelligence Weekly WordPress Vulnerability Report (October 26

Wordfence Intelligence has cataloged a significant number of security vulnerabilities affecting the WordPress ecosystem, with 549 issues identified across 351 plugins and 4 themes during the week of October 26 to November 1, 2026. This extensive report highlights the ongoing challenges in maintaining the security of the widely used content management system and its vast array of extensions.

The vulnerabilities detailed in this period range in severity, with notable examples including a critical unauthenticated Remote Code Execution (RCE) flaw in WordPress Core versions 4.7.0 through 7.1.3. This specific vulnerability, an "Upgrade-Window Staged-Installer" type, poses a severe risk as it could allow attackers to execute arbitrary code on a vulnerable WordPress installation without requiring any authentication. Additionally, The Grid plugin, up to version 2.8.1, also suffered from an unauthenticated RCE vulnerability, while YOOtheme Pro versions 5.0.0 to 5.0.52 contained an unauthenticated arbitrary file upload vulnerability.

In response to these discoveries, the Wordfence Threat Intelligence Team has deployed enhanced protection via firewall rules. Customers utilizing Wordfence Premium, Care, and Response services received immediate protection. However, users of the free Wordfence version will experience a 30-day delay before these protections are automatically applied, underscoring the benefits of their paid tiers for rapid security patching.

The report also breaks down the vulnerabilities by CVSS severity, revealing a substantial number of high and critical severity issues. Out of the total 549 vulnerabilities, 17 were classified as critical and 132 as high severity. The majority, 394, fell into the medium severity category, with only 6 classified as low severity. This distribution indicates a persistent trend of deeply impactful flaws being discovered within the WordPress plugin and theme landscape.

Analysis by CWE (Common Weakness Enumeration) type further illuminates the nature of these security weaknesses. "Improper Neutralization of Input During Web Page Generation" was the most prevalent, with 209 instances, followed by "Missing Authorization" (128) and "Deserialization of Untrusted Data" (35). These categories point to common coding errors related to input validation, access control, and insecure data handling, which are frequent vectors for exploitation.

Wordfence also recognized the contributions of 222 vulnerability researchers who reported issues during this period. Wordfence PRISM led the list with 59 reported vulnerabilities, followed by Ananda Dhakal with 29 and Karthik Ramakrishnan with 17. This collaborative effort between researchers and security firms like Wordfence is crucial for identifying and mitigating threats before they can be widely exploited.

The Wordfence Intelligence database, which is freely accessible via its user interface, API, and webhook integration, aims to provide the WordPress community with timely and actionable vulnerability information. This transparency and accessibility are key components of Wordfence's defense-in-depth strategy for securing WordPress sites globally.

This weekly report serves as a critical resource for site owners, developers, and security professionals to stay informed about the evolving threat landscape within the WordPress ecosystem. By understanding the types and severity of vulnerabilities being disclosed, stakeholders can prioritize patching efforts and implement appropriate security measures to protect their digital assets.