WordPress vulnerabilities hit 501 new disclosures

WordPress vulnerabilities disclosed between September 28 and October 4, 2026 affected 367 plugins and 9 themes, according to Wordfence Intelligence, which added 501 entries to its vulnerability database for that week.

Wordfence reported that 201 vulnerability researchers contributed WordPress security findings during the same period. Of the 501 vulnerabilities, 449 were listed as patched and 52 remained unpatched at the time they were added. By severity, Wordfence counted 20 critical vulnerabilities, 174 high severity issues, 306 medium severity issues and 1 low severity issue. For website owners, the practical message is straightforward: a WordPress site may be exposed even if only one installed plugin or theme is affected, so checking the actual software inventory matters more than looking at WordPress core alone.

The most common weakness class in the week was cross-site scripting, a flaw that can let an attacker make a website run unwanted code in a visitor browser. Wordfence counted 206 of those. Other prominent categories included 68 missing authorization issues, where software fails to check whether a user is allowed to perform an action, 42 SQL injection issues, where unsafe database commands may be triggered through user input, 34 sensitive information exposure issues and 30 deserialization of untrusted data issues, a risky handling of stored data that can sometimes lead to code execution depending on the application.

The critical entries show why plugin and theme maintenance is a hosting and business continuity issue, not just a developer chore. Wordfence listed patched unauthenticated remote code execution flaws in AcyMailing up to and including 11.0.5, Kirki up to and including 6.3.1 and SiteSkite up to and including 2.1.8. Remote code execution means an attacker may be able to run commands or code through the vulnerable site. Wordfence also listed patched critical authentication bypass or account takeover issues in DevKit Pro up to and including 2.3.0, Divi Membership up to and including 2.3.0, JSON API Auth up to and including 3.1.2, Ultimate Multisite up to and including 2.15.0 and WPMobile.App up to and including 11.82.

Several critical issues were marked unpatched. Wordfence listed Kognetiks Chatbot up to and including 2.4.9 as affected by unauthenticated arbitrary file upload, BackupSheep up to and including 1.8 as affected by unauthenticated arbitrary file deletion and Zombify up to and including 1.7.7 as affected by unauthenticated arbitrary file upload. In plain terms, an arbitrary file upload bug can let an attacker place a file of their choosing on a site, while arbitrary file deletion can let them remove files the site needs. For a live business website, either class of flaw can become an availability, integrity or recovery problem.

High severity entries included both unauthenticated and authenticated attack paths. Wordfence listed unpatched high severity flaws in WooCommerce Designer Pro up to and including 1.9.33, described as authenticated remote code execution for subscriber-level users and above, Product Designer App up to and including 1.1.3, described as unauthenticated arbitrary file read, WooCommerce Appointments up to and including 5.3.2, described as unauthenticated SQL injection, and WooCommerce Lottery up to and including 2.2.9, also described as unauthenticated SQL injection. The report also included patched high severity SQL injection issues in Ajax Search Pro, EduAdmin Booking, Paytm Payment Gateway, Unlimited Elements for Elementor, WP BASE Booking of Appointments, Services and Events, WP Data Access and WP Visitor Statistics.

Wordfence said its threat intelligence team reviews each vulnerability for impact, severity and exploitation likelihood, and that it deployed one new firewall rule during the week. The rule was identified as WAF-RULE-963, but its technical details were redacted while Wordfence worked with the vendor on a patch. Wordfence said Premium, Care and Response customers received that protection immediately, while users of the free version would receive it after a 30 day delay. Wordfence also stated that sites running its plugin with scanning enabled should already have been notified if affected by the listed vulnerabilities.

For site owners, the priority is to compare installed plugins and themes against the affected products and versions, then update patched software and remove or disable unpatched components where the risk is unacceptable. This is especially important for plugins handling payments, bookings, memberships, file uploads, forms, backups, e-commerce and user accounts, because many of the listed flaws affect exactly those types of site functions. A plugin with a low visible profile can still have high privilege in WordPress if it can read files, change users, process forms or talk to the database.

For organizations that prefer not to manage WordPress hardening alone, AEU Hosting is relevant here because it provides managed WordPress hosting, secured end to end. That does not replace checking whether a particular vulnerable plugin is installed, but it matches the operational problem this report highlights: WordPress security depends on continuous maintenance of the whole site stack, including third-party extensions.

The safe response is not to panic or remove every plugin blindly. It is to keep an accurate list of installed software, apply available updates, retire abandoned or unpatched components and review administrator accounts after any serious authentication, privilege escalation or file upload vulnerability appears on a site.