PT-2026-66743

Name of the Vulnerable Software and Affected Versions Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder versions prior to 6.2.9 Description An Insecure Direct Object Reference exists due to missing validation on a user-controlled key. Unauthenticated attackers...

PT-2026-66871

Name of the Vulnerable Software and Affected Versions WPGraphQL versions 2.0.0 through 2.15.0 Description An unauthenticated caller can distinguish existing author-class accounts and obtain public profile fields through the sendPasswordResetEmail mutation. While the mutation is designed to preven...

Exploit for Interpretation Conflict in Wordpress

CVE-2026-63030 | WP2Shell xpl0ited by gr1txhttps://gith...

WordPress MailerPress – Newsletter, email marketing & AI automation plugin <= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates vulnerability

Missing Authorization to Unauthenticated Contact Updates vulnerability discovered by Jakub Lipiński A3RES in WordPress Plugin MailerPress versions = 1.5.0...

Wordfence Intelligence Weekly WordPress Vulnerability Report (July 20, 2026 to July 26, 2026)

Last week, there were 249 vulnerabilities disclosed in 198 WordPress Plugins and 6 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 107 Vulnerability Researchers that contributed to WordPress Security last week. Review those vulnerabilitie...

NPM: dssrf has an SSRF bypass with remove_at_symbol_in_string

NPM: dssrf has an SSRF bypass with removeatsymbolinstring vulnerability discovered by ? in WordPress Npm dssrf versions = 1.0.3...

CVE-2026-5582

The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...

CVE-2026-15397

The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via the wpssfwinstallpluginconfiguration AJAX handler. This...

EUVD-2026-51096

The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...

CVE-2026-5582 FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle

The FuseWP plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.24.2. This is due to missing nonce verification on the togglesyncstatus function. This makes it possible for unauthenticated attackers to toggle the status of sync rules...

CVE-2026-5582

The FuseWP WordPress plugin (versions up to 1.1.24.2) is affected by a Cross-Site Request Forgery due to missing nonce verification in the toggle_sync_status() function. This enables unauthenticated attackers to toggle the status of sync rules (enable/disable) by luring a site administrator to pe...

WordPress Backup and Staging by WP Time Capsule plugin < 1.21.16 - Authentication Bypass vulnerability

Authentication Bypass vulnerability discovered by WebARX Security in WordPress Plugin Backup and Staging by WP Time Capsule versions 1.21.16...

WordPress Admin and Site Enhancements (ASE) Pro plugin <= 8.9.0 - Unauthenticated Remote Code Execution vulnerability

Unauthenticated Remote Code Execution vulnerability discovered by Nox Axter in WordPress Plugin Admin and Site Enhancements ASE Pro versions = 8.9.0...

CVE-2026-15397

The CVE concerns the WordPress plugin Subscriptions for WooCommerce (versions ≤ 2.0.0). The issue is Missing Authorization in the AJAX handler wps_sfw_install_plugin_configuration , allowing authenticated users with shop manager-level access or higher to install and activate arbitrary WordPress.o...

WordPress miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin < 7.8.0 - Unauthenticated Account Takeover vulnerability

Unauthenticated Account Takeover vulnerability discovered by Lyris Vale in WordPress Plugin WordPress Social Login and Register versions 7.8.0...

WordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.1 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by AeonRisk in WordPress Plugin MountDev AI MCP Connector for WordPress versions = 1.6.1...

CVE-2026-15255

The RegistrationMagic WordPress plugin before 6.0.9.4 does not properly validate that a one-time password presented in a cookie belongs to the identity being requested before returning front-end form submissions, allowing unauthenticated attackers to read other users' form submission data,...

CVE-2026-15257

The RegistrationMagic WordPress plugin before 6.0.9.4 does not perform authorization, ownership or nonce checks on a front-end submission-editing action, allowing unauthenticated attackers to overwrite other users' form submissions and the profile fields of the associated non-administrator...

CVE-2026-15382

The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.4 does not perform a capability or nonce check before deleting a site's custom-uploaded icon font packs, allowing unauthenticated attackers to permanently delete all of a site's custom icon fonts with a single request...

CVE-2026-14923

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...