Vulnerabilities in WordPress: What does it mean for your website?

This week, your website could be at risk if you're not paying attention

Imagine your website is like a house with doors and windows. If one of them has a security flaw, someone could enter without permission. This week, 93 such "doors" have been found in WordPress plugins and themes. Some allow an attacker to do things like take control of accounts, upload dangerous files, or even execute commands as if they were the owner. It's not a problem with your website specifically, but it's something you should know if you use WordPress.

What's happening in the world

This week, 93 critical vulnerabilities were identified in WordPress plugins and themes. That's a 67% decrease from last week, but it's still a high number. In total, 372 vulnerabilities were recorded this week, of which 93 are considered critical. This means there are flaws that allow attackers to act without needing an account on the website, or to execute malicious code.

The cards, CVE by CVE

CVE-2026-110135

• Affected product: Plugin "OTP Login & Register Woocommerce"
• What the flaw is: Allows an attacker to take control of an account without needing credentials.
• How it's exploited: By accessing a function in the plugin that doesn't require authentication.
• What could happen: An attacker could impersonate a legitimate user and access sensitive data.
• Severity (CVSS): 9.8
• Exploitability (EPSS): High
• Is it being exploited already?: No information on active exploitation.
• Consequences for your website: Could lead to user data theft or even the use of those accounts for malicious activities.

CVE-2026-108151

• Affected product: Plugin "MDTF – Meta Data and Taxonomies Filter"
• What the flaw is: Allows arbitrary code execution on the server.
• How it's exploited: Through malicious code injection.
• What could happen: An attacker could execute commands on the server as if they were the administrator.
• Severity (CVSS): 9.8
• Exploitability (EPSS): High
• Is it being exploited already?: No information on active exploitation.
• Consequences for your website: Could lead to malware installation, data theft, or even website downtime.

CVE-2026-92885

• Affected product: Plugin "Qode Membership"
• What the flaw is: Allows bypassing authentication via social login.
• How it's exploited: By using a vulnerability in the social login process.
• What could happen: An attacker could access accounts without knowing the password.
• Severity (CVSS): 9.8
• Exploitability (EPSS): High
• Is it being exploited already?: No information on active exploitation.
• Consequences for your website: Could lead to legitimate users losing control of their accounts.

CVE-2026-94169

• Affected product: Plugin "The Grid"
• What the flaw is: Allows arbitrary code execution on the server.
• How it's exploited: Through malicious code injection.
• What could happen: An attacker could execute commands on the server as if they were the administrator.
• Severity (CVSS): 9.8
• Exploitability (EPSS): High
• Is it being exploited already?: No information on active exploitation.
• Consequences for your website: Could lead to malware installation, data theft, or even website downtime.

CVE-2026-111832

• Affected product: Plugin "WP Mailster"
• What the flaw is: Allows uploading arbitrary files to the server.
• How it's exploited: By uploading a malicious file through a plugin function.
• What could happen: An attacker could install malware or even take control of the server.
• Severity (CVSS): 9.8
• Exploitability (EPSS): High
• Is it being exploited already?: No information on active exploitation.
• Consequences for your website: Could lead to malware installation, data theft, or even website downtime.

How we got here

The evolution of critical vulnerabilities in WordPress has been quite volatile in recent weeks. While last week saw 283 critical vulnerabilities, this week only 93 were identified, a 67% drop. However, the average of the last 5 weeks is 180, so this week is still below average. The peak was recorded the week of October 14 to 20 with 283 vulnerabilities, while the minimum is precisely this week with 93.

What's happening behind the numbers

This week's drop may be due to some of the most critical flaws from previous weeks being resolved or patched. However, the overall trend is still upward, suggesting that the number of critical WordPress vulnerabilities could continue to rise in the coming weeks. This could be due to plugin and theme developers frequently publishing updates that include security fixes. It could also be due to attackers identifying and publishing new flaws more quickly.

What we can expect

If the trend continues, it's likely that the number of critical WordPress vulnerabilities will keep rising in the coming weeks. The optimistic scenario would be that plugin and theme developers continue to publish frequent updates and users apply them quickly. The pessimistic scenario would be that attackers identify and publish new flaws more quickly, which could lead to an even greater increase in the number of critical vulnerabilities.

How it can affect your website or business

Scenario 1: An outdated plugin

Imagine you have an online store and you're using a social login plugin that you haven't updated. An attacker could exploit a vulnerability to access your customers' accounts. This could lead to the theft of sensitive data, such as email addresses or even passwords, which could cause your customers to lose trust in your store.

Scenario 2: A brute-force attack

Imagine you're using a weak password for your admin account and haven't enabled two-factor authentication. An attacker could use a bot to try millions of passwords until they find the right one. Once inside, they could change your website's settings, steal data, or even install malware.

Scenario 3: A public exploit

Imagine an exploit is published for a plugin you're using on your website. If you don't update the plugin quickly, automated bots could exploit the vulnerability to take control of your website. This could mean your website starts showing pharmacy ads or even goes completely offline.

How to protect yourself and prevent attacks

1. Update your plugins and themes regularly. Each update may include important security fixes.
2. Enable two-factor authentication (2FA). This adds an extra layer of security to your admin account.
3. Use strong and unique passwords. Don't use the same password on multiple sites.
4. Enable security analysis in Seguridad 360. This allows you to detect if your website has plugins or themes with known vulnerabilities.
5. Configure your website's firewall. This allows you to block attacks before they reach your application.
6. Enable BotLock. This allows you to control and block malicious bots and crawlers.
7. Make regular backups. In case your website is attacked, you can restore it quickly.
8. Subscribe to the Seguridad 360 security newsletter. This allows you to stay informed about the most recent vulnerabilities.

What SWPanel tools can help you

• Security analysis in Seguridad 360: Detects CMS, plugins, and versions with known flaws and marks your website in the panel.
• Security newsletter and alerts in Seguridad 360: Warns you when a flaw affects you.
• BotLock: Controls and blocks malicious bots and crawlers from your website.
• FireWall: Filters web attacks before they reach your application.
• Automatic CMS updates for websites installed from SWPanel: If you installed your website from SWPanel, you can enable this feature to keep your CMS updated.
• Backups: Allow you to restore your website in case of an attack.
• PHP version change from the hosting service: If you're using an unsupported PHP version, you can switch to a supported version from the panel.
• Ticket support: If you have questions or need help, you can contact our support team.

Quick summary

• This week, 93 critical vulnerabilities were identified in WordPress plugins and themes.
• Some allow an attacker to take control of accounts, upload files, or even execute code on the server.
• The trend of vulnerabilities is still upward, so it's important to stay alert.
• Update your plugins and themes, enable two-factor authentication, and use strong passwords.

Sources

The data for this week comes from international public catalogs such as CISA KEV, Wordfence, Nuclei, Exploit-DB, Emerging Threats, and EPSS.