WordPress vulnerabilities draw 1,077 reports in July
WordPress vulnerabilities generated 1,077 submissions to the Wordfence Bug Bounty Program in July 2026, 1.0% more than in the previous month. Wordfence said 281 researchers were active, down 8.2%, while 84 reports were classed as high threat, up 44.8%. Another 73 fell into its common and dangerous category, an increase of 62.2%, and 15 web application firewall rules were released, up 114.3%. A web application firewall filters harmful requests before they reach a website.
Of the 1,077 reports, Wordfence accepted 243 as in scope, marked 17 out of scope, rejected 610 and identified 207 as duplicates. Its process covers technical validation, contact with the affected vendor, confirmation of a patch and firewall coverage where applicable. Wordfence says Premium, Care and Response customers receive applicable firewall protection in real time, while free users receive it after 30 days. Vendors can use its free vulnerability management portal to track reports concerning their software.
The program defines high-threat findings as flaws capable of producing a complete site compromise, including unrestricted file uploads or Remote Code Execution, which means making the server run commands chosen by an attacker. These must be exploitable without an account or through a low-level account, in software with at least 25 active installations. The common and dangerous category covers stored cross-site scripting, where hostile code is saved and later runs in visitors' browsers, and SQL injection, where malicious database commands are inserted through unprotected input. Those findings must affect software with at least 500 installations and be reachable by unauthenticated or low-privilege attackers.
Wordfence awarded $51,183 in July, averaging $210.63 for each validated, eligible submission. The largest single award was $15,600 for an unauthenticated arbitrary file upload in Elementor Pro 4.2.1 and earlier, caused by bypassing validation of an upload-field array. The software was listed with 5 million installations. Other leading awards were $2,048 for a forged upload-field configuration affecting Forminator Forms 1.56.1 and earlier, with 600,000 installations; $975 for an authentication bypass in User Profile Builder 3.16.4 and earlier that could lead to administrator takeover, with 40,000 installations; $804 for unauthenticated stored cross-site scripting in Independent Analytics 2.15.0 and earlier, with 100,000 installations; and $800 for unauthenticated SQL injection in Unlimited Elements For Elementor 2.0.16 and earlier, with 300,000 installations.
CWE, or Common Weakness Enumeration, is a standard catalogue used to classify software security mistakes. The most frequently accepted class was CWE 79, covering unsafe output during webpage generation, with 80 submissions, $13,415 in total rewards and a $167.69 average. Dangerous file uploads, CWE 434, produced 18 submissions but the largest category payout at $21,909, averaging $1,217.17. SQL injection also had 18 submissions and paid $2,968. Other common classes included improper privilege management with 16 reports, restricted-path failures with 10, improper authentication with 11, user-controlled authorization bypass with nine, missing authorization with nine, unsafe code generation with three and alternate-path authentication bypass with two. Single findings involving incorrect type conversion and untrusted data deserialization earned $975 and $615 respectively.
Unauthenticated flaws dominated the listed access categories, with 163 vulnerabilities and an average reward of $350.84. Subscriber-level flaws accounted for 60 at an average of $133.37, while 14 unauthenticated findings requiring interaction through a user interface averaged $74. Four custom-access cases averaged $19.67. Installation reach also affected prioritisation. The largest group covered software with 1,000 to 49,999 installations, accounting for 81 findings with an average CVSS score of 7.4 and an average reward of $147.53. CVSS, the Common Vulnerability Scoring System, rates technical severity on a numerical scale. Off-repository software produced 31 findings, an average score of 9.0 and an average reward of $871.60. Software with 100,000 to 999,999 installations accounted for 38 findings and averaged $384.87.
The most consequential case involved WordPress Core versions 6.9 through 7.0.1. A researcher from Assetnote / Searchlight Cyber found that the REST API batch endpoint at /wp-json/batch/v1 could be abused for Remote Code Execution. A REST API is an interface through which software sends structured requests to another application. Wordfence's analysis says route checking and validation could become desynchronised, allowing a validated sub-request to reach an unintended callback. This bypassed the allow_batch restriction and the destination route's input sanitisation, while preserving attacker-controlled parameters. The weakness could then be chained with SQL injection to execute code on the server.
The WordPress Security Team released versions 6.8.6, 6.9.5 and 7.0.2 on Friday, July 17, 2026. The release addressed two vulnerabilities that could be chained into unauthenticated Remote Code Execution, a combination commonly called wp2shell. WordPress described the issues as one critical and one high-severity flaw and enabled forced automatic updates for affected releases because of the severity.
A separate incident affected Advanced Responsive Video Embedder for Rumble, Odysee, YouTube, Vimeo, Kick in versions 10.8.7 and 10.8.8. Wordfence PRISM detected a hardcoded backdoor within two hours of its introduction. The plugin's _arve_uc_init() function ran early on every request and accepted a token through the _wplogin or _wpm parameter. It compared that token with a fixed SHA-256 value embedded in publicly accessible source code, without a nonce, capability check or password validation. A nonce is a one-time value intended to show that a request came from an expected page or session. Anyone possessing the universal token could select an existing administrator account and obtain full control of the site. Wordfence assessed that an attacker likely introduced the code after gaining commit access to the developer's account, although that cause was not confirmed.
Site owners should install the WordPress Core security releases and review every listed plugin for updates or removal. They should also inspect the administrator list for unfamiliar accounts, particularly if the affected video plugin was installed. For organisations that want hosting operations handled as a managed service, AEU Hosting provides managed WordPress hosting secured end to end. The July results underline that rapid updates remain essential because the most serious findings required no existing account and could expose an entire website.