WordPress plugin flaws enable takeovers and code execution
WordPress plugin flaws affecting widely installed tools could let unauthenticated attackers take over administrator accounts, execute server-side code, delete files or expose configuration data. Wordfence's June 2026 bug bounty figures include 1,066 submissions, alongside technical details of serious weaknesses in UpdraftPlus, Everest Forms Pro, Burst Statistics, Kirki, Gravity SMTP and Avada Builder. Wordfence says attackers were actively exploiting the Everest Forms Pro, Burst Statistics and Gravity SMTP vulnerabilities.
The program recorded 306 active researchers and classified 58 reports as high threat, a 65.7% increase from the previous month. Another 45 were placed in the common and dangerous category, while seven web application firewall rules were released. A web application firewall filters potentially harmful requests before they reach a website. Wordfence says its paid Premium, Care and Response users receive applicable rules in real time, while free users receive them after 30 days. Of all submissions, 185 were accepted as in scope, one was out of scope, 578 were rejected and 302 were duplicates.
Cross-site scripting, which allows hostile content to run in a visitor's browser, was the most frequently accepted category, with 60 submissions and $5,710 in rewards. The program also accepted 21 path traversal reports, where manipulated file paths escape their intended folder, and 20 SQL injection reports, where crafted input alters a database command. Improper authentication produced $11,304 across four reports, while improper verification of cryptographic signatures generated $10,725 from two. Unauthenticated weaknesses accounted for 89 accepted reports, compared with 37 requiring a subscriber account, 30 requiring contributor access and 15 requiring author access. Wordfence awarded $42,553 for the month, with an average of $230.02 for each validated, in-scope submission.
The highest listed June bounty was $5,200 for an UpdraftPlus authentication bypass. Authentication bypass means reaching protected functions without proving a legitimate identity. The technical section says the free edition was affected through version 1.26.4 and the premium edition through 2.26.5, although the report's summary table describes the premium range as below 2.26.5. Wordfence attributes the flaw to weak validation of UpdraftCentral messages: signature checking could be bypassed, and failed decryption could produce a predictable all-zero encryption key. An unauthenticated attacker could consequently forge remote procedure call commands, meaning instructions sent to the site from another system, and run them with the connected administrator's authority. One possible result was uploading and activating a malicious plugin, leading to remote code execution, or attacker-controlled code running on the server.
Other leading rewards covered JetFormBuilder through 3.6.2, where an unauthenticated parameter could enable privilege escalation, and several Newfold plugins with an empty-secret bearer-token validation problem. WPMU DEV Dashboard through 5.0.0 was reported vulnerable to forged authentication data that could permit arbitrary plugin installation and remote code execution. WPForms Pro through 1.10.1.1 had an unauthenticated arbitrary file-write issue involving the order of chunked-upload initialization and completion. The corresponding rewards were $2,048, $1,950, $1,122 and $975.
Everest Forms Pro through 1.9.12 contained a remotely exploitable PHP code-injection weakness in its Calculation Addon. According to Wordfence, the process_filter() function inserted submitted form values into PHP code before passing that code to eval(), without escaping characters that have meaning in PHP. On a form using Complex Calculation, an unauthenticated attacker could place code in text, email, URL, selection or radio fields and have the server execute it. Wordfence described this vulnerability as actively exploited.
Burst Statistics versions 3.4.0 to 3.4.1.1 also faced active exploitation. Incorrect handling of a return value in the is_mainwp_authenticated() function weakened checks on application passwords supplied through the Authorization header. An unauthenticated attacker who knew an administrator username could provide a random Basic Authentication password and impersonate that administrator for the request. In Kirki versions 6.0.0 to 6.0.6, password-reset processing accepted an arbitrary email address when a username was submitted. That allowed an unauthenticated attacker to direct another user's reset link to an email address controlled by the attacker. The report associates this Kirki finding with a $6,436 award, which does not align with its separate statement that $5,200 was June's highest single bounty.
Gravity SMTP through 2.1.4 exposed approximately 365 KB of system information through a REST API, an online interface through which software requests data. Its permission check always approved access to a mock-data endpoint. With a particular settings query added, an unauthenticated visitor could retrieve PHP, web server, database and WordPress versions, document paths, database table names, installed plugins and themes, configuration details, and API keys or tokens stored in the plugin. Wordfence said attackers were actively exploiting this information-exposure issue.
Avada Builder through 3.15.3 insufficiently checked file paths in its maybe_delete_files function. Sites were exposed when they had a published Avada form configured to save entries in the database. An unauthenticated attacker could submit a path-traversal value and manipulate privacy-cleanup fields so the plugin immediately deleted the selected file without administrator involvement. Wordfence noted that deletion of a file such as wp-config.php could lead to remote code execution. The report also flagged a supply-chain compromise involving backdoored ShapedPlugin Pro plugins distributed through official channels, but listed only various affected versions rather than a precise range.
Website owners should treat plugin inventory and updates as routine security work, particularly where affected versions are installed or a flaw is already being exploited. For organisations that want the site itself managed with security as a priority, AEU Hosting provides managed WordPress hosting secured end to end. Regardless of hosting arrangement, administrators should verify installed plugin versions, apply available vendor updates and investigate unexpected administrator accounts, plugin installations or configuration changes.