@wordfence

Protecting over 5 million WordPress sites. Get Wordfence at https://xitter.cf/t.co/6EE41qCKVB #WordPress #Security

 Seattle, WA
wordfence.com
Joined June 2012
  • Tweets3.9K
  • Following32
  • Followers8.3K
605Media
The Wordfence Q2 2026 Quarterly WordPress Threat Intelligence Report has been published. Here are some of the most important findings: • 2,073 Total Vulnerabilities Published (-24.3% from previous quarter) • 182 High Threat Vulnerabilities (+15.2% from previous quarter) • 357 Common & Dangerous Vulnerabilities (+80.3% from previous quarter) • 10.4B WAF Attacks Blocked (+14.3% from previous quarter) • 18.2B Brute Force Attacks Blocked (+13.8% from previous quarter) • 573K Sites Infected (+21.0% from previous quarter) Read the full report for more data and insights: wordfence.com/blog/2026/09/q…

Quarterly WordPress Threat Intelligence Report – Q2 2026

Wordfence's Q2 2026 threat intelligence report covers 2,073 published WordPress vulnerabilities, 182 high threat vulnerabilities, 10.4 billion blocked WAF attacks, 18.2 billion blocked brute force...

wordfence.com
1
4
504
Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our Testing Found wordfence.com/blog/2026/10/c…

Why It’s Urgent to Update PHP on Your WordPress Site: Two Critical PHP Vulnerabilities and What Our...

Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, can allow unauthenticated code execution. Updating WordPress won't fix them. Update and restart PHP.

wordfence.com
1
3
8
421
PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35 as soon as possible. wordfence.com/blog/2026/10/p…

PSA: PHP Security Updates Available for Two Critical Vulnerabilities, Update Now

The PHP project has released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. We...

wordfence.com
2
1
17
631
🚨 Two Critical PHP Vulnerabilities: Security Update Scheduled for October 21 — What WordPress Site Owners Need to Know wordfence.com/blog/2026/10/p…

PSA: Upcoming Critical PHP Security Release PSA: Upcoming Critical PHP Security Release

A critical PHP security release is scheduled for October 21, 2026. Learn what WordPress site owners should do now to prepare for the update.

wordfence.com
1
10
3
33
2,753
Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator wordfence.com/blog/2026/10/w…

Wordfence Argus Discovers High Severity Unauthenticated PHP Object Injection in Duplicator

Wordfence Argus helped uncover CVE-2026-82814, a high-severity unauthenticated PHP object injection in Duplicator and Duplicator Pro. Update to version 5.0.0 or newer.

wordfence.com
4
1
6
1,040
PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites wordfence.com/blog/2026/10/u…

PSA: UpdraftCentral Connection Key Compromise Used to Install Malicious Plugins on WordPress Sites

TeamUpdraft has disclosed unauthorized access to its teamupdraft.com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database...

wordfence.com
6
4
516
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026) wordfence.com/blog/2026/10/w…

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026)

Last week, there were 655 vulnerabilities disclosed in 406 WordPress Plugins and 100 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 236...

wordfence.com
1
3
343
600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin Update Backuply to version 1.5.9 as soon as possible. wordfence.com/blog/2026/10/6…

600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin

On September 17th, 2026, we received a submission for a Second-Order SQL Injection vulnerability in Backuply, a WordPress plugin with more than 600,000 active installations. This vulnerability makes...

wordfence.com
3
7
1
13
719
Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded PDFs Into Thumbnails on Your Server Update Ghostscript to version 10.08.0 or later as soon as possible. wordfence.com/blog/2026/10/w…

Wordfence Argus Discovers Critical Vulnerability in Ghostscript, the Program That Turns Uploaded...

On September 8, 2026, Artifex released Ghostscript 10.08.0, closing a critical heap buffer overflow that the Wordfence Threat Intelligence team, using Wordfence Argus, discovered and reported sixteen...

wordfence.com
1
6
441
The Web is built on the assumption that some math problems are too hard to solve. That assumption depends on our current knowledge of math, and that knowledge just jumped by around 700 proofs in a day. wordfence.com/blog/2026/10/c…

Cybersecurity Imperatives Will Demand AI Math

Cybersecurity is built on math, and if public key encryption falls and we don’t have a replacement ready, the Web grinds to a halt.

wordfence.com
2
322
Weekly WordPress Vulnerability Report: September 14-20, 2026 Last week brought 358 vulnerabilities across 243 WordPress plugins and 4 WordPress themes. Read the full report: wordfence.com/blog/2026/09/w…

Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20,...

Last week, there were 358 vulnerabilities disclosed in 243 WordPress Plugins and 4 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 184...

wordfence.com
3
1
2
6
553
PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core Update to 7.1.2 or your branch's fix now. A path traversal flaw in WordPress Core lets an attacker with no account make the site include a readable PHP file from outside the active theme directory. On some sites that can lead to remote code execution and full site compromise. Read Full Report: wordfence.com/blog/2026/09/p…

PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core

WordPress has released security updates for a critical unauthenticated path traversal vulnerability that can lead to local PHP file inclusion and, on affected server and theme configurations, remote...

wordfence.com
1
4
1
14
617
We analyzed a stealthy WordPress must-use plugin that hides itself and a rogue admin account from the dashboard and REST API, harvests plaintext admin passwords, restores itself after deletion, and exfiltrates data via an Ethereum smart contract. wordfence.com/blog/2026/09/i…

Inside a Malicious, Stealthy WordPress Must Use Plugin

The Wordfence Threat Intelligence Team identified an interesting malware sample in mid June during a site clean. The malware was installed as a must-use plugin with several self-healing mechanisms in...

wordfence.com
1
2
1
3
498
Wordfence Argus Discovers Critical Vulnerability in libheif, the Library That Opens iPhone Photos on Your Server wordfence.com/blog/2026/09/w…

Wordfence Argus Discovers Critical Vulnerability in libheif, the Library That Opens iPhone Photos...

Wordfence Argus found a critical CVSS 9.8 vulnerability in libheif, a library many servers use to process HEIC images. We demonstrated protected-file disclosure and code execution on one exact...

wordfence.com
2
354
100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS Update Tutor LMS to version 4.0.8 as soon as possible. wordfence.com/blog/2026/09/1…

100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability...

Wordfence Argus discovered a PHP Object Injection vulnerability in Tutor LMS, affecting more than 100,000 WordPress sites. Subscriber-level attackers could achieve remote code execution. Update to...

wordfence.com
2
5
401
Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin Update Wholesale Lead Capture to version 2.0.3.2 as soon as possible. wordfence.com/blog/2026/09/a…

Attackers Actively Exploiting Critical Vulnerability in WooCommerce Wholesale Lead Capture Plugin

On February 20th, 2026, a critical Unauthenticated Arbitrary File Upload vulnerability was publicly disclosed in WooCommerce Wholesale Lead Capture, a premium WordPress plugin with an estimated 6,000...

wordfence.com
1
4
2
7
450
Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin Update The Events Calendar to version 6.17.4.1 as soon as possible. wordfence.com/blog/2026/09/w…

Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code...

On August 21 and August 22, 2026, Wordfence Argus, created by the Wordfence Threat Intelligence team, identified two independent critical vulnerability chains in The Events Calendar, a WordPress...

wordfence.com
3
7
404
Weekly WordPress Vulnerability Report: August 31-6, 2026 Last week there were 277 vulnerabilities across 187 WordPress plugins and 7 WordPress themes. Read the full report: wordfence.com/blog/2026/09/w…

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)

Last week, there were disclosed in and that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those...

wordfence.com
1
3
1
5
395
Weekly WordPress Vulnerability Report: August 24-30, 2026 Last week brought 246 vulnerabilities across 174 WordPress plugins and 5 WordPress themes. Read the full report: wordfence.com/blog/2026/09/w…

Wordfence Intelligence Weekly WordPress Vulnerability Report (August 24, 2026 to August 30, 2026)

Last week, there were 246 vulnerabilities disclosed in 174 WordPress Plugins and 5 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 121...

wordfence.com
2
2
9
467
Load more