WordPress Security Blog
Weekly vulnerability reports, security tips, and WordPress security news to keep your site safe.
Server-Side Request Forgery (SSRF) on WordPress: Turning Your Server Into a Weapon
SSRF tricks your WordPress server into making requests on an attacker's behalf, reaching internal systems and cloud metadata. Learn how it works and how to block it.
Privilege Escalation on WordPress: How a Low-Level Account Becomes an Admin
Privilege escalation lets an attacker turn a subscriber account or a plugin bug into full admin control. Learn how it happens and how to prevent it.
Abandoned Plugins: The Supply-Chain Risk Hiding in Your WordPress Site
An abandoned plugin can turn into an open door overnight. Learn why unmaintained and sold plugins are a supply-chain risk and how to audit yours.
WordPress Vulnerability Report: July 9 – July 16, 2026
203 WordPress vulnerabilities disclosed between July 9 – July 16, 2026. 11 critical, 49 high severity. 2 patched, 201 unpatched.
WordPress Vulnerability Report: July 8 – July 15, 2026
197 WordPress vulnerabilities disclosed between July 8 – July 15, 2026. 10 critical, 52 high severity. 2 patched, 195 unpatched.
WordPress Vulnerability Report: July 1 – July 8, 2026
103 WordPress vulnerabilities disclosed between July 1 – July 8, 2026. 9 critical, 37 high severity. 0 patched, 103 unpatched.
WordPress Vulnerability Report: June 26 – July 3, 2026
142 WordPress vulnerabilities disclosed between June 26 – July 3, 2026. 8 critical, 37 high severity. 2 patched, 140 unpatched.
WordPress Vulnerability Report: May 17 – May 24, 2026
81 WordPress vulnerabilities disclosed between May 17 – May 24, 2026. 8 critical, 20 high severity. 2 patched, 79 unpatched.
WordPress Vulnerability Report: May 9 – May 16, 2026
104 WordPress vulnerabilities disclosed between May 9 – May 16, 2026. 6 critical, 23 high severity. 1 patched, 103 unpatched.
WordPress Vulnerability Report: May 1 – May 8, 2026
96 WordPress vulnerabilities disclosed between May 1 – May 8, 2026. 6 critical, 35 high severity. 1 patched, 95 unpatched.