WordPress vulnerabilities hit 268 across plugins and themes
WordPress vulnerabilities disclosed from October 19 to October 25, 2026, reached 268 across 182 plugins and 15 themes, according to additions made to the Wordfence Intelligence Vulnerability Database. Of those flaws, 225 were patched and 43 remained unpatched. The disclosures included seven critical, 69 high, 186 medium and six low severity issues, with 124 vulnerability researchers contributing findings during the week.
The severity ratings use CVSS, the Common Vulnerability Scoring System, which assigns a score from 0 to 10 to indicate how serious a security flaw may be. All seven critical vulnerabilities were rated either 9.8 or 9.1 and were listed as patched. Advanced Custom Fields: Extended and its Pro edition through version 0.9.2.7 had an unauthenticated remote code execution flaw, CVE-2026-94267, meaning an attacker could run code without first signing in. Version 0.9.2.7 was also affected by account takeover and privilege escalation, where an attacker gains permissions that should not be available, under CVE-2026-94268. The free edition through 0.9.2.7 additionally had an arbitrary file deletion issue, CVE-2026-112311. These disclosures were published between October 20 and October 23.
The other critical issues were CVE-2026-115806 in Prime Mover through 2.2.1, involving PHP object injection through a Base64-encoded comment during migration search and replacement; CVE-2026-111832 in WP Mailster through 1.9.1.0, allowing arbitrary file uploads; CVE-2026-102785 in YOOtheme Pro versions 5.0.0 through 5.0.52, also allowing arbitrary file uploads; and CVE-2026-111833 in weForms through 1.6.28, allowing arbitrary file deletion. PHP object injection is the unsafe processing of specially constructed data that can make an application perform unintended actions. These four flaws were published from October 19 through October 22 and were marked patched.
Several high severity vulnerabilities had no patch when entered in the database. Academist Core through 1.4.1 had unauthenticated local file inclusion, CVE-2026-112820, which could make the site load a local file that should not be accessible. Participants Database through 2.7.8.5 had both PHP object injection, CVE-2026-112862, and SQL injection, CVE-2026-112860. SQL injection means hostile database commands can be inserted through inadequately protected input. EventON Subscriber through 1.4.5 had another unauthenticated SQL injection flaw, CVE-2026-93300, involving its email parameter.
An unpatched group of PHP object injection flaws affected Hallelujah through 1.1.1, Helion through 1.1.12, Holistic Center through 1.2.6, Hostme v2 through 7.0, HotLock through 1.3.9, Little Birdies through 1.3.16, Redy through 1.3.5, Reprizo through 1.0.8, Rhodos through 1.3.3, Save Life through 1.2.14, Vagabonds through 1.3.10 and ZenSoul through 1.13. Hostme v2 through 7.0 also had unpatched stored cross-site scripting, CVE-2026-112849, while KALLYAS through 4.25.0 had the same weakness under CVE-2026-112863. Stored cross-site scripting allows malicious browser code to be saved by a site and later delivered to visitors or administrators. Your Dress through 1.4.1 had unpatched local file inclusion, CVE-2026-112850.
Patched high severity findings covered a broad range of attack paths. Duplicator through 1.5.17 and Duplicator Pro through 4.6.10 had unauthenticated PHP object injection, CVE-2026-82814. Classified Listing through 6.1.5 had code execution available to Subscriber-level users, CVE-2026-111828. Royal Addons for Elementor through 1.7.1068 had remote code execution available to Contributor-level accounts, CVE-2026-111851. Royal MCP before 1.5.7 had authentication bypass, CVE-2026-111958. Ajax Search Lite through 4.14.6, Amelia through 2.4.11, two Click n Chat version ranges, Newsletters through 4.18.1 and Product Filter for WooCommerce through 3.4.6 were among the products with patched unauthenticated SQL injection flaws.
Stored cross-site scripting accounted for many further high severity disclosures. Patched affected products included Anti-Spam by CleanTalk through 6.89.1, Better Messages through 3.1.3, Contact Form Email through 1.3.68, Eventin through 4.1.26, Jane Menu through 1.5.0, LiteSpeed Cache before 7.9.2, Ninja Forms through 3.15.5, Otter Blocks before 3.2.8, PixelYourSite free and Pro before 11.4.3, SureCart through 4.9.5, W3 Total Cache through 2.10.7, WebP Express through 0.25.15, Weglot through 6.4.2 and WP Mailster through 1.9.1.0. Most of these were unauthenticated, so an attacker would not need a WordPress account.
The most common weakness category was missing authorization, recorded 75 times. CWE, or Common Weakness Enumeration, is a standardized way to classify software security mistakes. Improper handling of input during web-page generation followed with 69 findings, while untrusted-data deserialization accounted for 20. Other totals included 16 authorization bypasses through user-controlled keys, 13 SQL command injection weaknesses, 11 cases where server-side security depended on checks performed in the visitor's browser, 10 sensitive-information exposures, eight privilege-management flaws, seven code-generation control issues and six authentication flaws. The database also recorded five cross-site request forgery issues, five incorrect authorization flaws, five data-authenticity verification weaknesses, four PHP file inclusion problems, four path restriction flaws and four dangerous file upload issues. Smaller categories covered input validation, CAPTCHA guessing, authorization, link resolution and uncontrolled resource consumption.
Wordfence also deployed a firewall rule for a UDRPC key compromise affecting UpdraftPlus through 1.26.11. A firewall rule is a filter intended to block matching malicious requests. Wordfence Premium, Care and Response customers received the rule immediately, while the free plugin was scheduled to receive it after a 30-day delay. The company says its vulnerability database contains more than 40,000 records and can be accessed through its free interface, application programming interface and webhook integration, which can automatically send notices to another system.
Site owners should compare every installed plugin and theme with the affected versions, install available updates and remove software that is unused or remains unpatched. A backup should be made before updating, but it should not be treated as a substitute for installing security fixes. Wordfence says sites using its plugin with scanning enabled should already have received notices when affected. For organisations that prefer operational help with this work, AEU Hosting provides managed WordPress hosting secured end to end.