WPDeeply
Download free plugin

WPDeeply WordPress Security Research

The WPDeeply archive of WordPress plugin vulnerability disclosures.

77
Disclosures
All severities Subscribe to the disclosure feed
Record Finding
30 Oct 2026 WordPress Core < 7.1.4 - Unauthenticated Upgrade-Window RCE Under Active Attack WordPress Core before 7.1.4 contains a high-severity unauthenticated race condition in the core update process. Automated exploitation attempts began shortly after release; update and block public… 29 Oct 2026 Checkout Files Upload for WooCommerce before 2.4.0 – Actively Exploited File Upload (CVE-2026-103688) Checkout Files Upload for WooCommerce versions earlier than 2.4.0 contain a critical unauthenticated arbitrary file upload vulnerability tracked as CVE-2026-103688. Patchstack lists the flaw as actively… 28 Oct 2026 YOOtheme Pro 5.0.0-5.0.52 – Actively Exploited Unauthenticated File Upload (CVE-2026-102785) YOOtheme Pro versions 5.0.0 through 5.0.52 contain a critical unauthenticated arbitrary file upload vulnerability tracked as CVE-2026-102785. Wordfence reports blocking 1,002 attacks in a 24-hour period.… 28 Oct 2026 Pie Register Premium through 3.8.4.0 – Actively Exploited Unauthenticated File Upload (CVE-2026-84999) Pie Register Premium versions 3.8.4.0 and earlier contain a critical unauthenticated arbitrary file upload vulnerability tracked as CVE-2026-84999. Patchstack lists the flaw as actively exploited. Update… 27 Oct 2026 Prime Mover through 2.2.1 – Unauthenticated PHP Object Injection (CVE-2026-115806) Prime Mover – Backup and Migration versions 2.2.1 and earlier contain a critical unauthenticated PHP object injection vulnerability tracked as CVE-2026-115806. The issue is rated CVSS… 25 Oct 2026 Newsletters <= 4.18.1 - Unauthenticated Object Injection and SQL Injection Newsletters versions through 4.18.1 contain critical unauthenticated PHP object injection and SQL injection vulnerabilities. Update to 4.18.2 or later. 25 Oct 2026 Product Filter by WBW <= 3.4.6 - Unauthenticated Blind SQL Injection (CVE-2026-112866) Product Filter for WooCommerce by WBW versions through 3.4.6 contain a critical unauthenticated blind SQL injection. Update to 3.4.7 or later and review frontend filter traffic. 24 Oct 2026 LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS (CVE-2026-113499, CVE-2026-113500) LiteSpeed Cache versions before 7.9.2 contain two unauthenticated stored XSS vulnerabilities affecting specific CDN and font optimization configurations. Update immediately and purge cached pages. 22 Oct 2026 PHP 8.2-8.5 – Critical Unauthenticated RCE (CVE-2026-109618, CVE-2026-109619) CVE-2026-109618 and CVE-2026-109619 are critical unauthenticated PHP RCE flaws affecting WordPress servers. Update to PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 or a vendor-confirmed patched package, then restart… 21 Oct 2026 Duplicator <= 1.5.17 / Pro <= 4.6.10 - Unauthenticated PHP Object Injection CVE-2026-82814 is a high-severity unauthenticated PHP object injection affecting Duplicator Free 20 Oct 2026 UpdraftCentral Cloud Key Compromise – Signed Commands Install Malicious WordPress Plugins Active attacks used compromised UpdraftCentral Cloud connection keys to send signed commands and install malicious WordPress plugins. Update to 1.26.13/2.26.13 or later, revoke all keys, and… 19 Oct 2026 Kirki up to 6.3.2 – Unauthenticated Sensitive User Data Exposure (CVE-2026-107762) Kirki through 6.3.2 can expose user profile data through an unauthenticated frontend REST authorization bypass. Update to 6.4.0 or later.

WPDeeply has documented WordPress plugin vulnerabilities since 2020. The disclosures below remain at their original URLs, credited to the researcher who found them, with remediation information kept current.

Historical disclosures

Research methodology

Findings are verified against a local reproduction before publication, reported to the vendor first, and published once a patched version is available or the disclosure deadline has passed. Full detail is on the methodology page.

Responsible disclosure

If you have found a vulnerability in a WordPress plugin or theme and want it published here, read responsible disclosure first. Researchers keep their credit; WPDeeply does not claim other people’s findings.

Attribution note

The 2020–2021 disclosures in this archive were researched and published by Slavco Mihajloski (mslavco). WPDeeply’s current operators preserve and maintain that work; they did not discover it.