WordPress sites face 318 newly listed flaws

WordPress site owners have a large patch list to review after Wordfence said it added 318 vulnerabilities in 221 WordPress plugins to the Wordfence Intelligence Vulnerability Database for the week of September 21 to September 27, 2026. The company attributed the disclosures to 156 vulnerability researchers and said 305 of the listed issues were patched, while 13 remained unpatched at the time of publication.

The severity mix matters for website owners because not all plugin bugs carry the same operational risk. Wordfence classified 14 vulnerabilities as critical, 79 as high severity and 225 as medium severity. CVSS, the Common Vulnerability Scoring System, is the scoring method used to rate how serious a security flaw is. In this set, the most common weakness type was cross-site scripting, where unsafe input can make a website run unwanted script code in a visitor or administrator browser. Wordfence counted 95 cross-site scripting entries, followed by 59 missing authorization issues, 26 authorization bypass issues using user-controlled keys and 24 SQL injection issues, where unsafe database queries can expose or alter stored data.

Several critical entries are especially relevant for site administrators because they involve unauthenticated access, meaning an attacker would not need to be logged in. Wordfence listed Automation Web Platform up to and including 4.8.6 as affected by CVE-2026-14281, an unauthenticated privilege escalation issue through the wawp_custom_fields parameter, with a CVSS score of 9.8 and patch status marked patched. Give Tributes up to and including 2.3.1 was listed with CVE-2026-19658, an unauthenticated PHP object injection issue through the give_tributes_ecard_notify recipient personalized parameter, also rated 9.8 and marked patched. PHP object injection is a flaw where unsafe handling of stored PHP data objects can let an attacker interfere with application behavior.

Wordfence also listed Meta Box AIO up to and including 3.11.0 and standalone plugin extensions with CVE-2026-13355, described as unauthenticated privilege escalation to administrator through the rwmb_frontend_field_object_id parameter. The affected software entries shown include Meta Box AIO, Meta Box Frontend Submission and Meta Box User Profile, and the issue is marked patched. Other critical patched entries include miniOrange OTP Login, Verification and SMS Notifications up to and including 5.5.5 with CVE-2026-85984, an unauthenticated authentication bypass through the mo_wp_login_intent parameter, Paytium up to and including 5.0.3 with CVE-2026-18467, an unauthenticated privilege escalation issue, Ultra Addons for Contact Form 7 up to and including 3.5.50 with CVE-2026-82901, an unauthenticated arbitrary file upload through a signature form field, Visual Composer Website Builder up to and including 45.16.0 with CVE-2026-12227, an unauthenticated local file inclusion through the vcv-template parameter, and YAHMAN Add-ons up to and including 0.9.30 with CVE-2026-75799, an unauthenticated remote code execution issue.

One critical plugin entry was not patched in the data Wordfence published: Request a Quote for WooCommerce up to and including 2.9.2, tracked as CVE-2026-18143, an unauthenticated arbitrary file upload issue through an AJAX popup handler. Arbitrary file upload flaws are important for hosting and ecommerce teams because file upload paths can become a route to place unwanted files on a website if the vulnerable component does not properly restrict what can be uploaded. Wordfence also listed Customer Reviews for WooCommerce up to and including 5.120.0 with CVE-2026-89055, a critical unauthenticated arbitrary attachment deletion issue marked patched, and Online Scheduling and Appointment Booking System, Bookly, up to and including 28.2 with CVE-2026-93399, a critical booking token disclosure and deletion issue marked patched.

The high severity group included a patched WordPress core issue: WordPress up to and including 7.1.1, tracked as CVE-2026-87902, described by Wordfence as an unauthenticated local file inclusion issue through locate_template() path traversal. Local file inclusion means a flaw can make software load a file from the same system that it should not load, and path traversal means input can be shaped to reach files outside the intended folder. Wordfence said its Threat Intelligence Team reviewed vulnerabilities for impact, severity and likelihood of exploitation, and that it rolled out enhanced firewall rules for three redacted issues while working with vendors on patches, plus the WordPress core local file inclusion issue. According to Wordfence, Premium, Care and Response customers received those protections immediately, while free users receive the enhanced protection after a 30 day delay.

Other high severity examples show the range of plugin functions affected. Wordfence listed CartFlows up to and including 3.2.0 with CVE-2026-96837, an authenticated Contributor or higher remote code execution issue, Elementor Website Builder versions 4.3.0 to 4.3.1 with CVE-2026-62062, a cross-site request forgery issue through REST nonce bypass to privilege escalation, s2Member up to and including 260814 with CVE-2026-19804, an unauthenticated remote code execution issue through the first_name parameter in PayPal Proxy Return, Ninja Forms up to and including 3.15.3 with CVE-2026-91827, an unauthenticated PHP object injection issue, and WebFacing Email Accounts for cPanel versions 5.3 to 5.3.6 with CVE-2026-84069, an unauthenticated local file inclusion issue. Several unpatched high severity SQL injection or server-side request forgery entries were also listed, including Bluff Post up to and including 1.1.1, Rename wp-login.php to anything you want up to and including 2.0.1, SPS-Suite up to and including 1.4.0 and Testimonials Widget up to and including 4.0.4.

For businesses, the practical message is inventory first, then update or remove risk. A WordPress installation can depend on many plugins for forms, payments, bookings, memberships, maps, galleries, reviews and ecommerce workflows, so a vulnerable plugin may sit outside the obvious security stack. Wordfence said sites running its plugin with the scanner enabled should already have been notified if affected, but owners should still compare their installed plugin list and versions against the affected software they use, especially where an issue is unpatched or unauthenticated. For readers running business sites, AEU Hosting is relevant because it provides managed WordPress hosting, secured end to end, which aligns with the need to keep WordPress environments maintained and security-focused. No exploitation claims were included in the Wordfence data cited here, so the immediate action is to verify exposure, apply available fixes and disable or replace plugins where no patch is available.