WordPress attacks rise despite fewer new flaws in Q2 2026
WordPress attacks measured by Wordfence increased during Q2 2026 even as the number of newly published vulnerabilities declined. The company recorded 10.4 billion requests blocked or logged by its Web Application Firewall (WAF), a tool that filters malicious website traffic, up 14.3% from the previous quarter. It also blocked 18.2 billion brute-force attempts, in which attackers repeatedly try passwords to gain access, an increase of 13.8%. These figures come from Wordfence telemetry and describe activity observed across the websites it protects, rather than every WordPress site worldwide.
Wordfence added 2,073 vulnerabilities to its intelligence database during the quarter, 24.3% fewer than in Q1 2026. However, the number it classified as high threat rose 15.2% to 182. The company describes this category as flaws that attackers are likely to target and that can generally enable a complete site compromise with limited prerequisites. Another 357 entries were classified as common and dangerous, an increase of 80.3%. Wordfence said it was responsible for remediating and disclosing 47.4% of all vulnerabilities, 53.3% of high-threat cases and 32.2% of common and dangerous cases recorded in its database during the quarter.
At the end of Q2, 149 of the recorded vulnerabilities remained unpatched. Most of the vulnerabilities published during the period could be exploited without authentication, meaning an attacker would not first need to sign in. Plugins accounted for the majority of affected software. Cross-site scripting, which can make a website run unwanted code in a visitor's browser, was the largest class with 600 vulnerabilities. Missing authorization checks followed with 416, while SQL injection, which manipulates commands sent to a site's database, accounted for 213. Wordfence also counted 121 cross-site request forgery flaws, 103 cases involving unsafe handling of stored data, 101 remote file inclusion flaws, 87 sensitive-information exposures, 85 authorization bypasses using user-controlled identifiers, 76 path traversal flaws and 51 unrestricted dangerous-file uploads.
The WAF data shows both growing traffic and a wider set of apparent sources. Wordfence counted 19.7 million unique IP addresses in firewall attacks, up 16.7%, and 72.9 million unique user agents, up 263.7%. A user agent is the identifying information that software sends with a web request, although attackers can alter it. The company's IP threat feed blocked 3.1 billion requests, down 7%, while the number of unique addresses on its blocklist rose 58.9% to 353,000. Wordfence released 16 WAF rules during the quarter, 27.3% fewer than in the previous one. Its telemetry was drawn from more than five million protected websites.
The most heavily targeted listed flaw was an unauthenticated privilege-escalation issue in LiteSpeed Cache <= 6.3.0.1, associated with 49,711,496 blocked requests. Privilege escalation means obtaining permissions beyond those an account or visitor should have. It was followed by multiple vulnerable actions in WPGraphQL <= 0.2.3 with 29,403,849 requests, and an arbitrary file-upload flaw in N-Media Post Front-end Form < 1.1 with 23,130,942. Wordfence also blocked 12,610,278 requests targeting authentication bypass and privilege escalation in WooCommerce Payments 4.8.0 through 5.6.1, and 10,602,932 targeting an authorization bypass that could create an unauthenticated administrator in SureTriggers <= 1.0.78.
Other frequently targeted entries included sensitive-information disclosure through an unprotected REST API in Ninja Forms <= 3.5.7, with 9,975,128 blocked requests, and privilege escalation through an unprotected REST API endpoint in Rank Math SEO <= 1.0.40.2, with 7,110,040. An authorization bypass in POST SMTP Mailer, Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 drew 4,890,917 requests. Missing authorization in Discount Rules for WooCommerce <= 2.0.2 accounted for 3,797,139. An arbitrary file-upload issue available to Contributor-level or higher users in Envato Elements <= 2.0.10 and Template Kit <= 1.0.13 generated 1,742,988 blocked requests.
Password attacks also became more distributed. Wordfence observed 106.2 million unique IP addresses taking part in brute-force activity, 55.9% more than in the prior quarter. At the same time, the average number of requests per address fell 27% to 171. For site owners, that combination reinforces the value of two-factor authentication (2FA), which asks for a second proof of identity in addition to a password, as well as unique passwords and restrictions on repeated login attempts.
Malware detection rose alongside attack traffic. Malware is software or code placed on a site to perform harmful or unauthorized actions. Wordfence reported 31.6 million unique malware files, up 15.2%, and detected malware on 573,000 sites, up 21%. Affected sites averaged 49.3 infected files, down 4.8%, and 2.2 malware variations, down 7.8%. The company released 85 malware signatures, which are patterns used to identify malicious files, 4.5% fewer than in Q1. Its report notes that malicious PHP files are often associated with backdoors, webshells, information theft and payment skimming, while JavaScript and HTML infections are often connected to spam.
The practical priority is to inventory every installed plugin and theme, apply available updates promptly and remove software that is unused or remains unpatched. Site owners should combine access controls such as 2FA with regular malware scans, backups and monitoring for unexpected file or account changes. For readers who want the hosting layer handled as part of this work, AEU Hosting offers managed WordPress hosting secured end to end. The quarter's figures show why lower vulnerability publication totals should not be mistaken for lower operational risk: high-threat flaws, exploitation requests, password attacks and malware detections all increased in Wordfence's dataset.