WordPress vulnerabilities this month: plugins, themes and core (1–25 October 2026)
Between 1 and 25 October 2026, Wordfence published 1,613 new WordPress vulnerabilities: 1,459 in plugins, 147 in themes and 7 in WordPress core. As of 25 October 2026, 413 (26%) had no patched version listed, 972 (60% of those with a CVSS vector) needed no login to exploit, and none appeared in CISA's catalogue of vulnerabilities known to be exploited.
By Jarek Piotrowski · Data as of · Updated weekly
- New vulnerabilities
- 1,613, 1–25 October 2026
- No patched version listed
- 413 (26%), as of 25 October 2026
- No login needed
- 972 (60% of those with a CVSS vector)
- Known exploited (CISA)
- 0
By type and severity
What to do on your own site
- Update plugins, themes and WordPress core, and turn on automatic updates where you can.
- Delete plugins and themes you don't use: deactivated code can still be reached.
- For a plugin with no patch yet, check whether you can switch it off or replace it until one ships.
- Keep tested backups, and know who to call at your host.
Or have it looked after: website management is $99 a month. If you'd rather have less to patch at all, see why static sites on Cloudflare have less to patch.
Already hacked, or want it checked? Hacked WordPress clean-up is from $690 on a fixed quote, and a WordPress hardening check is $390.
Still on PHP 8.2 or older? Its security fixes end on 31 December 2026; see the PHP upgrade.
Why it matters more now AI is speeding attacks up: AI and website security: what Australian small businesses should do.
AI and WordPress security in 62 seconds
Read the transcript
Is your website one plugin update away from a problem?
Australia's cyber agency says AI is helping attackers work faster and at scale, including more convincing phishing emails.
On WordPress, the most heavily attacked flaws were first exploited about five hours after they went public.
So the basics matter more than ever: updates, strong logins, backups, and properly set-up email.
Start free. Our WordPress vulnerabilities page is updated weekly.
Want it checked? The hardening check covers updates, logins and backups. A$390, flat.
Already hacked? Book a free 15-minute assessment. Clean-up is from A$690, on a fixed quote.
Website form sending through Microsoft 365 with just a password? That changes in December. The email sending fix is A$490.
No one can promise a site can't be hacked. But a patched site is much harder to break into.
LayerOps. Check it free, then fix it for a fixed price.
Sources: ASD's ACSC Annual Cyber Threat Report 2024–25, pp.10 and 34; Patchstack, State of WordPress Security in 2026. Scenes and voice are AI-generated; the vulnerabilities page shown is a real capture (Wordfence data as of 23 Oct 2026).
How the numbers are counted
More disclosures don't necessarily mean more attacks. More vulnerabilities are being found and reported, partly through automated and AI-assisted research. The count measures disclosures, not attacks.
- A vulnerability counts in the month Wordfence published it. Informational records are left out.
- Duplicates are removed by Wordfence record ID, then by CVE ID.
- "No patch available" means no patched version was listed as of 25 October 2026; some will have been patched since.
- "No login needed" means the CVSS vector says no privileges are required (PR:N).
- "Known exploited" means the CVE appears in CISA's Known Exploited Vulnerabilities catalogue as of 25 October 2026.
Vulnerability data: Wordfence Intelligence, published by Defiant, Inc., used under the Wordfence Intelligence licence. Known-exploited status: CISA Known Exploited Vulnerabilities catalogue (CC0). Neither Defiant nor CISA endorses LayerOps or this page. Wordfence Intelligence.
Copyright 2012-2026 Defiant Inc. Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Licence