Last week, there were 497 vulnerabilities disclosed in 327 WordPress Plugins and 23 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 218 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. Our mission with … Read more

On October 21, 2026, the PHP project released emergency updates for two critical vulnerabilities that can allow an unauthenticated attacker to run code through the PHP service handling website traffic. We first alerted WordPress site owners to these updates in our initial public service announcement. The vulnerabilities are tracked as CVE-2026-109618 and CVE-2026-109619, and each … Read more

On October 21st, 2026, the PHP project released emergency updates for two critical vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. We warned site owners before the fixes became available and followed up after our team reviewed the vulnerability details and began testing the patched and vulnerable PHP releases. At this time, we have not observed any … Read more

TeamUpdraft has disclosed unauthorized access to its teamupdraft.com website over the weekend of October 17-18, 2026. The company believes its customer database was accessed and says that database contained connection keys for UpdraftCentral, UpdraftVault, and UpdraftClone, along with customer account information. Public analysis by Nethemba and reports submitted directly to Wordfence have documented attackers using … Read more

On August 30, 2026, during internal research, the Wordfence Threat Intelligence Team discovered an Unauthenticated PHP Object Injection vulnerability in Duplicator and Duplicator Pro. Duplicator has more than one million active installations. The vulnerability is tracked as CVE-2026-82814 and carries a CVSS 3.1 score of 8.8 (High). This is a second-order vulnerability. An unauthenticated attacker … Read more