wpprobe

"Because why scan blind when WordPress exposes itself?" WPProbe A fast WordPress plugin and theme scanner that detects installed plugins via REST API enumeration and themes from HTML discovery, then maps them to known vulnerabilities. Over 5000 plugins detectable without brute-force, thousands mo...

CVE-2023-6875

CVE-2023-6875 CVE-2023-6875 PoC This is the original proof of concept given to Wordfence for my participation in its Holiday Bug Bonanza An extra was given for this proof of concept code Thank you to Wordfence for the opportunity! I had a lot of fun during the Bug Bonanza and hope that it happens...

WordPress Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin <= 11.2.9 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin Quiz And Survey Master versions = 11.2.9...

Wordfence Intelligence Weekly WordPress Vulnerability Report (November 2, 2026 to November 8, 2026)

Last week, there were 497 vulnerabilities disclosed in 312 WordPress Plugins and 1 WordPress Theme that have been added to the Wordfence Intelligence Vulnerability Database, and there were 218 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilities...

What’s New in Wordfence 9.1.0: Security News, Faster Rules and Smarter Alerts

Update, November 11, 2026: Wordfence 9.1.1 is now available. This small follow-up release updates the bundled list of trusted root certificates cacert.pem that Wordfence uses to verify secure connections. It adds no new features and changes no settings, and everything in this post still applies. ...

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 26, 2026 to November 1, 2026)

Last week, there were 549 vulnerabilities disclosed in 351 WordPress Plugins and 4 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 222 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

Wordfence Price Increase Coming December 3, 2026

On Thursday, December 3, 2026 , pricing for Wordfence Premium, Care, and Response will increase. We’re announcing this change a month in advance so you have time to purchase new licenses or renew eligible subscriptions at current pricing. Existing licenses can be renewed up to one year before the...

Wordfence Bug Bounty Program Monthly Report – July 2026

In July 2026, the Wordfence Bug Bounty Program received 1077 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...

Introducing the Wordfence Threat Response Team: A New Way to Report Active Threats in the WordPress Ecosystem

When a new threat to WordPress sites emerges, the first hours matter most. Today we're introducing the Wordfence Threat Response Team , led by Alex Thomas and made up of some of our most experienced researchers and threat analysts. It's a small, hands-on team focused on turning rapidly emerging...

Wordfence Intelligence Weekly WordPress Vulnerability Report (October 12, 2026 to October 18, 2026)

Last week, there were 520 vulnerabilities disclosed in 344 WordPress Plugins and 28 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 221 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabiliti...

nuclei-wordfence-cve

Nuclei + Wordfence = ♥ 86,413 Nuclei Templates for WordPress Security Scanning 🥳 Level up your WordPress security game! This project's got a treasure trove of fresh Nuclei templates for WordPress. Scan for weaknesses in Core, plugins, and themes – all based on the latest intel from Wordfence.com...

Wordfence Intelligence Weekly WordPress Vulnerability Report (September 28, 2026 to October 4, 2026)

Last week, there were 512 vulnerabilities disclosed in 372 WordPress Plugins and 10 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 201 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabiliti...

Quarterly WordPress Threat Intelligence Report – Q2 2026

As the leader in WordPress security, Wordfence provides unparalleled security coverage that fully encompasses protection, active monitoring, detection, and response all built around our threat intelligence, demonstrating a strong commitment to security. Our mission is to ensure comprehensive...

Wordfence Bug Bounty Program Monthly Report – June 2026

In June 2026, the Wordfence Bug Bounty Program received 1066 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat...

WordPress SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin <= 4.7.42 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read vulnerability

Authenticated Administrator+ Path Traversal to Arbitrary File Read vulnerability discovered by Wordfence PRISM in WordPress Plugin SSL Zen versions = 4.7.42...

Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026)

Last week, there were 362 vulnerabilities disclosed in 247 WordPress Plugins and 4 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 186 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

Inside a Malicious, Stealthy WordPress Must Use Plugin

The Wordfence Threat Intelligence Team identified an interesting malware sample in mid June during a site clean. The malware was installed as a must-use plugin with several self-healing mechanisms in place in order to survive removal. It also makes use of Etherhiding, a technique that hides the...

WordPress Search Atlas SEO – OTTO AI SEO Automation for WordPress plugin <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Whitelabel Password Modification vulnerability discovered by Wordfence PRISM in WordPress Plugin Search Atlas SEO versions = 2.6.23...

WordPress NEX-Forms – Ultimate Forms Plugin for WordPress plugin <= 9.3.0 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin NEX-Forms versions = 9.3.0...

Boost Engagement with Free Passkeys by Wordfence

Imagine you can sign in with one click. Now imagine all the users on your WooCommerce store or WordPress powered website can sign in with one click. Firstly it makes your life a lot easier. But more importantly, you’ve removed friction from users logging in to make purchases, to engage in your...