As cited
Copy frozen at (site build).
vulnerabilities
Wordfence Intelligence Weekly WordPress Vulnerability Report (August 31, 2026 to September 6, 2026)
Wordfence Intelligence released its weekly vulnerability report for August 31 to September 6, 2026, documenting 277 vulnerabilities across 187 WordPress plugins and 7 themes, with 254 patched and 23 unpatched. The disclosure includes 16 critical vulnerabilities (CVSS 9.8) spanning privilege escalation, remote code execution, and authentication bypass, alongside 75 high-severity and 185 medium-severity issues. Most vulnerabilities involve cross-site scripting, missing authorization, and SQL injection vectors.
Why it matters: WordPress site operators should immediately patch or update affected plugins and themes, particularly those running ACPT Premium, Advanced Custom Fields Extended, Authorizer, Amelia, Divi Ajax Filter, and others with critical flaws enabling account takeover and remote code execution. Hosting providers and security teams using Wordfence's free scanning tools should prioritize testing their infrastructure against these 277 new entries to identify exposure before malicious actors exploit the disclosed weaknesses.
- Source published
- First seen by Cybersecurity Tracker