Project
WordPress is an open-source content management system powering websites and blogs via themes and plugins, available hosted (WordPress.com) or self-hosted.
Artifex fixed Ghostscript CVE-2026-39919 in 10.08.0 on September 8, closing a heap overflow present in versions 9.21 through 10.07.1. Wordfence, which found the flaw, has seen no exploitation in the wild yet.
Reality
Novamira's free WordPress plugin lets Claude Code, Cursor or Codex run PHP, WP-CLI, database queries and file edits on a site. According to a dev.to review, Novamira itself says only the operator's attention stands between the agent and production.
Reality
Attackers are exploiting CVE-2026-85097, a CVSS 10.0 unauthenticated upload flaw in the Bricksforge WordPress plugin, Patchstack reported. Versions through 3.1.8.9 are affected; 3.1.8.10 is the first fixed build.
Perspective Coverage
3 publishersReality
SOCRadar estimates broker CyberXero stole more than 628,000 records from four Ukrainian organizations with Claude Code and Cobalt Strike. The actor left a server open, and its logs show where the model's refusals held and where a fresh session got around them.
Reality
A dev.to analysis of 199 Shopify stores found 43% of product pages have a first-loaded image with no width or height. Image format is mostly settled at 94% WebP or AVIF, but 19.5% of pages have a first image with no alt attribute.
Reality
Super Forms CVE-2026-17609 (CVSS 9.1) lets unauthenticated visitors recursively delete server directories when file cleanup is enabled. Versions through 6.3.316 are affected, and 6.3.317 fixes it, a dev.to analysis says.
Reality
LovedByAI's logs from 7 October 2026 attribute 703 of 1,022 ChatGPT-User 404s on 111 small-business sites to exploit probes. Counting ChatGPT's 404s by user-agent string mostly counts the scanner, so the client IP needs checking against OpenAI's published ranges.
Reality
CVE-2026-93485 lets an anonymous WordPress comment run script in a logged-in admin's browser the moment the page loads, with no click required. The sanitizer that cleans the comment on save and the display filters that reformat it read a stray newline differently, and an admin who views it lends the script their plugin-install rights, enough to reach remote code execution.
Reality
WordPress shipped 7.1.2 on 22 September 2026 to patch CVE-2026-87902, an unauthenticated path-traversal flaw rated 9.2 that reaches every release since 4.7.0. CISA listed it as known-exploited three days later.
Reality
CVE-2026-93485 was fixed on September 17 in WordPress 7.1.1. An anonymous comment plants a script, an administrator opens the page, and the script uploads a plugin carrying a web shell. Affected versions go back to 4.7.
Perspective Coverage
5 publishersReality
One actor is exploiting stored XSS flaws in two WordPress plugins, one installed on more than 500,000 sites, to plant backdoors and rogue administrator accounts. Patchstack says updating the plugins blocks further exploitation but will not clean a site that is already compromised.
Reality
WordPress released 7.1.2 on 22 September 2026 to fix remote file inclusion flaw CVE-2026-87902, and the first exploit attempt was recorded the same day. The fix was back-ported to every maintained branch down to 4.7, so an exposed site has hours before scanners find it.
Reality
Sucuri says a WordPress backdoor it calls SC keeps itself in at least eight places across files, the database and shared memory. Cleaning the plugin or wiping files on disk does not clear it, because any surviving copy rewrites the rest on the next page load.
Reality
Cloudflare's EmDash 1.0 CMS starts each sandboxed plugin with only its own storage and blocks seven kinds of site resource until an admin approves. It answers the WordPress model, where every plugin shares the site's PHP process with direct access to its database, files and network.
Reality
Dartmouth and Lancaster researchers tie 88 non-consensual deepfake sites to five mainstream web providers led by Cloudflare, Google and Namecheap. The sites surfaced in keyword searches and every provider already bans illegal use, so the gap the study points to is enforcement.
Reality
Cloudflare's EmDash 1.0 runs each CMS plugin in its own isolate capped at 50ms of CPU per request, a dev.to breakdown says. Isolation limits what a bad plugin can reach, and choosing which publisher keys to trust stays with the site owner.
Reality
Matt Mullenweg's 84% vote returned him to control of Automattic 33 hours after its board put him on leave. For businesses on WordPress.com, WooCommerce or Tumblr, that vote is the governance they are buying into, whoever he names to the board.
Perspective Coverage
3 publishersReality
Professional IT Services reviewed all 15 volume-backed Deployments on its K3s cluster after a routine node upgrade caused a three-hour outage. Three now use Recreate, because the default rolling update can stall on a ReadWriteOnce volume.
Reality
Unauthenticated attackers can drop PHP onto WordPress sites running Forminator 1.56.1 or earlier. The install base is 600,000; the exposed subset depends on how the forms were built.
Reality
Check Point Research says exposed directories revealed the logs, source code and management tooling behind StopAndProtect, a campaign it links to more than 5,000 infected machines.
Perspective Coverage
3 publishersReality
Security · August 19, 2026 · Confirmed4 publishers
Security · September 26, 2026 · Confirmed2 publishers
Security · August 25, 2026 · Confirmed5 publishers
Security · August 28, 2026 · Confirmed3 publishers
Security · August 30, 2026 · One report1 publisher
Security · August 29, 2026 · Confirmed3 publishers
Security · September 3, 2026 · Confirmed3 publishers
Security · September 16, 2026 · Confirmed3 publishers
Security · September 16, 2026 · Confirmed2 publishers
Security · September 21, 2026 · Confirmed2 publishers
Build · September 24, 2026 · One report1 publisher
Security · September 17, 2026 · Confirmed3 publishers
Build · September 16, 2026 · One report1 publisher