WordPress vulnerabilities hit 498 across plugins and themes
WordPress vulnerabilities disclosed from October 12 to October 18, 2026 reached 498 across 328 plugins and 23 themes, according to Wordfence Intelligence. Of those flaws, 431 were listed as patched and 67 remained unpatched. Wordfence credited 218 vulnerability researchers with contributing findings during the week, while its PRISM program accounted for 40 entries. The volume means site owners should check installed extensions by exact product and version rather than assume a routine WordPress core update addresses the risks.
The severity breakdown included 23 critical, 153 high, 316 medium and six low severity vulnerabilities. These ratings use CVSS, the Common Vulnerability Scoring System, which assigns a score reflecting a flaw's potential impact and ease of exploitation. The largest technical category was improper handling of input used to generate web pages, with 159 cases, followed by 116 missing authorization flaws. Wordfence also recorded 34 SQL injection issues, where manipulated input can alter database commands, and 33 cases involving unsafe deserialization, where stored data is reconstructed into software objects without adequate checks. Other totals included 31 sensitive information exposures, 22 privilege management flaws, 20 authorization bypasses involving user-controlled keys, 15 code-generation weaknesses, 11 dangerous file uploads and 10 path traversal issues that could reach files outside an intended directory.
The remaining categories were nine insufficient authenticity checks, seven cross-site request forgery flaws, six improper authentication issues, five unsafe PHP include or require controls, four cases of client-side enforcement for server-side security, three incorrect authorization flaws, three server-side request forgery issues, two general input-validation flaws and two redirects to untrusted sites. Single findings involved unsafe concurrent access to a shared resource, embedded malicious code, improper access control, unsafe output passed to another component, command injection and insufficiently random values.
Nineteen critical flaws received a CVSS score of 9.8. These included an unauthenticated arbitrary file upload in 10Web Booster through version 2.34.10, tracked as CVE-2026-108587, and two Abandoned Cart Pro for WooCommerce flaws through version 10.8.0: authentication bypass through a recovery link, CVE-2026-97657, and SQL injection through guest cart data, CVE-2026-97668. Unauthenticated means an attacker would not need to sign in. AGE-GATE through version 1.0 had an unpatched PHP code injection issue allowing remote code execution, meaning commands could be run on the server, under CVE-2026-104800. JTL-Connector for WooCommerce through 2.4.3 also remained unpatched for arbitrary file upload, CVE-2026-87855.
Other 9.8-rated issues were patched in ELEX WordPress HelpDesk through 3.3.7, CVE-2026-103768; LearnPress through 4.4.10, CVE-2026-104736; MailOptin through 1.2.78.6, CVE-2026-109515; Mang Board 2.4.4, CVE-2026-109219; MDTF through 1.3.9, CVE-2026-108151; My Calendar through 3.8.7, CVE-2026-104798; OTP Login & Register Woocommerce through 2.7.2, CVE-2026-110135; Printcart Store through 2.9.1, CVE-2026-93388; SimpleForm through 3.10.0, CVE-2026-104748; Sunshine Photo Cart through 3.7.4, CVE-2026-104730; The Grid through 2.8.1, CVE-2026-94169; and Theme My Login through 7.2.1, CVE-2026-89079. Rank Math SEO PRO 3.0.123 was listed as patched for embedded malicious code under CVE-2026-111862. Snazzy Social Media Feed through 2.5 remained unpatched for an arbitrary file upload flaw, CVE-2026-110002.
Four more critical findings scored 9.1. LatePoint through 5.7.4 had a patched authentication bypass caused by a race condition in its one-time-password attempt counter, CVE-2026-110653. Click to Chat through 4.44 had a patched arbitrary shortcode execution issue, CVE-2026-92097, while File Upload to Order through 1.1.3 had a patched arbitrary file deletion flaw, CVE-2026-107594. BuddyPress XProfile Custom Image Field through 3.1.0 remained unpatched for unauthenticated arbitrary file deletion; the database entry shown by Wordfence did not list a CVE identifier.
High-severity findings included remote code execution or file upload flaws in affiliate-toolkit, DoubleScale CRM, Email Customizer for WooCommerce, FV Flowplayer, HivePress, MapSVG, WP Photo Album Plus and YaySMTP. The required access ranged from subscriber to contributor or other product-specific roles. PilotPress through 2.0.43 and Salon Booking System versions 10.17 through 10.31.10 had patched privilege-escalation issues. Gravity Forms before 3.1.1 had a patched unauthenticated PHP object injection flaw, CVE-2026-97296, while Backuply through 1.5.8 and Search Regex 3.5 had patched flaws rated 8.0 that could lead to privilege escalation or remote code execution.
A notable theme cluster remained unpatched at the time of publication. Avventure, Bonbon, Coinpress, Edge Decor, EmojiNation, Filmax, gamezone, Gamic, Good Homes, Gunslinger, Le Truffe, Legal Stone, Marcell, Meals & Wheels, Mission, Motorix, Muzicon, Nuts and Orpheus were each listed with unauthenticated PHP object injection vulnerabilities rated 8.1. The affected upper versions ranged by theme, and the entries carried CVE identifiers from CVE-2026-61997 through CVE-2026-62018, with gaps in that sequence. Wordfence also reported unpatched high-severity issues in Contact Form 7 Signature Addon through 4.2.2, Gmedia Photo Gallery through 1.25.1 and JTL-Connector through 2.4.3.
Wordfence said it deployed WAF-RULE-966 and WAF-RULE-967 while withholding technical details as it worked with vendors on patches, plus protection for a PHP object injection issue in comments. A WAF, or web application firewall, examines web requests and can block known malicious patterns. Premium, Care and Response customers received those rules immediately, while the free plugin was scheduled to receive them after a 30-day delay. Wordfence also offers free access to its vulnerability interface, API and webhook integrations, including a database containing more than 40,000 vulnerabilities; a webhook automatically sends an update to another service when database information changes.
Sites using the Wordfence plugin with scanning enabled should have received notices when affected, but administrators still need to act on those warnings. For unpatched products, disabling and removing the affected extension is the clearest way to eliminate its code from the site until a corrected release is available. For organisations that prefer the site platform to be managed as a service, AEU Hosting provides managed WordPress hosting secured end to end. Whatever the hosting arrangement, owners should maintain an inventory of active plugins and themes, remove software they no longer use and verify that installed versions are outside the affected ranges.