Last week, the number of critical vulnerabilities in WordPress increased by 102.2% compared to the previous one. This doesn't mean your website is in danger, but it's a good time to review which plugins and themes you have installed and whether they're up to date. Even though not all websites use the affected products, attackers don't know that and search everywhere. That's why it's important to be prepared.
What's happening in the world
SWPanel constantly monitors vulnerabilities published in sources like Wordfence, CISA KEV, Nuclei, and EPSS. This week, 666 new vulnerability entries were identified in WordPress, of which 182 are considered critical. This represents an increase of 102.2% compared to the previous week and a rise of 4.8% compared to the average of the last five weeks. The overall trend is upward, indicating that developers and attackers remain active in this ecosystem.
The vulnerabilities, CVE by CVE
CVE-2026-94268 (Advanced Custom Fields: Extended)
- Affected product: Plugin "Advanced Custom Fields: Extended" version <= 0.9.2.7
- What the flaw is: Allows an unauthenticated attacker to take control of a user account, as if they were the website owner.
- How it's exploited: By exploiting an error in how the plugin handles permissions.
- What could happen: The attacker could change passwords, publish content, or even sell access to others.
- Severity (CVSS): 9.8
- Likelihood of use (EPSS): High
- Is it being exploited already?: No active exploitation reported.
CVE-2026-119096 (Uncanny Toolkit for LearnDash)
- Affected product: Plugin "Uncanny Toolkit for LearnDash" version <= 3.8.2
- What the flaw is: Allows an unauthenticated attacker to bypass credential verification, as if you had no password.
- How it's exploited: By manipulating a parameter in a web request.
- What could happen: Unauthorized access to restricted areas of the website.
- Severity (CVSS): 9.8
- Likelihood of use (EPSS): High
- Is it being exploited already?: No active exploitation reported.
CVE-2026-106013 (Jupiter X Core)
- Affected product: Plugin "Jupiter X Core" version <= 4.61.0
- What the flaw is: Allows an unauthenticated attacker to trick the social login system, as if they were a legitimate user.
- How it's exploited: By using a false value in a Twitter or X verification parameter.
- What could happen: Unauthorized access to user accounts.
- Severity (CVSS): 9.8
- Likelihood of use (EPSS): High
- Is it being exploited already?: No active exploitation reported.
CVE-2026-84999 (Pie Register Premium)
- Affected product: Plugin "Pie Register Premium" version <= 3.8.4.0
- What the flaw is: Allows an unauthenticated attacker to upload arbitrary files to the website, as if they were a legitimate user.
- How it's exploited: By using a poorly protected AJAX function.
- What could happen: Upload of malicious files that could infect the website or steal data.
- Severity (CVSS): 9.8
- Likelihood of use (EPSS): High
- Is it being exploited already?: No active exploitation reported.
CVE-2026-109516 (Bot for Telegram on WooCommerce)
- Affected product: Plugin "Bot for Telegram on WooCommerce" version <= 1.3.0
- What the flaw is: Allows an unauthenticated attacker to trick the Telegram system into granting access to user accounts.
- How it's exploited: By using a fake Telegram webhook and brute force.
- What could happen: Unauthorized access to user accounts and data theft.
- Severity (CVSS): 9.8
- Likelihood of use (EPSS): High
- Is it being exploited already?: No active exploitation reported.
And what about SWPanel?
SWPanel actively monitors these vulnerabilities and cross-references them with the data of websites hosted on our servers. If we detect that your website is using any of these tools with affected versions, we notify you in the Security 360 section. Additionally, if you installed your website from SWPanel, you can enable automatic updates for WordPress, plugins, and themes, which helps keep your website secure without you having to worry about it.
How we got here
The evolution of critical vulnerabilities in WordPress has been fluctuating in recent weeks. Let's look at the data:
- 22/09 to 26/09: 122 critical vulnerabilities
- 29/09 to 03/10: 132 (+8.2%)
- 06/10 to 10/10: 240 (+81.8%)
- 13/10 to 17/10: 284 (+18.3%)
- 20/10 to 24/10: 90 (-68.3%)
- 27/10 to 02/11 (this week): 182 (+102.2%)
The average of the last five weeks is 174, and this week we exceeded that average. The highest peak was 284, and the lowest was 90. The overall trend is upward, indicating that developers continue to publish fixes and attackers remain active.
What's happening behind the numbers
The increase in critical vulnerabilities in WordPress reflects constant activity from both developers and attackers. On one hand, developers publish updates to fix flaws. On the other hand, attackers look to exploit any unpatched vulnerabilities. This week, the 102.2% increase suggests that several important fixes have been published, which doesn't necessarily mean they are being actively exploited, but it's a good time to review your website.
What we can expect
If the trend continues, it's likely that the number of critical vulnerabilities will keep growing in the coming weeks. An optimistic scenario would be that developers keep publishing quick updates and attackers don't find new ways to exploit the flaws. A pessimistic scenario would be that attackers find automated ways to exploit these flaws, which could lead to an increase in real attacks.
How it can affect your website or business
Scenario 1: Website downtime
Imagine you have an online store and use a plugin with an unpatched vulnerability. An attacker could exploit it to inject malicious code that brings your website down. This means your customers can't access your store, resulting in lost sales and frustrated customers.
Scenario 2: Data theft
If an attacker takes control of your website, they could steal customer data such as addresses, emails, or even credit card numbers. This not only affects your reputation but could also make you legally liable if you don't comply with the GDPR.
Scenario 3: Loss of search engine ranking
If your website is infected with malware, Google may mark it as unsafe, causing it to disappear from search results. This means your store or blog loses visibility and customers.
How to protect yourself and prevent attacks
- Update plugins and themes regularly: Updates often include security fixes. If you installed your website from SWPanel, you can enable automatic updates.
- Use strong passwords and 2FA: A weak password is like a toy lock. Use long, unique passwords and enable two-factor authentication (2FA) to add an extra layer of security.
- Review installed plugins: Don't use plugins you don't need. Every plugin is a potential door for attackers.
- Use a web firewall: A firewall filters malicious requests before they reach your website. If you have an active firewall, it's like having a doorman who checks who enters.
- Enable security analysis in Security 360: This analysis detects if your website uses plugins or themes with known vulnerabilities. It helps you identify problems before anyone else does.
- Make regular backups: If your website gets infected, a recent backup lets you recover it quickly. It's like having a spare key to your house.
- Use a bot blocker: Automated bots try to guess passwords or find vulnerabilities. A bot blocker stops them before they can do any damage.
- Keep PHP updated: If your website uses an unsupported PHP version, it won't receive security patches. Switch to a supported version from the hosting panel.
- Enable security notifications: If you installed your website from SWPanel, you can receive notifications when a vulnerability affecting your website is published.
- Review user permissions: Make sure only necessary users have access to sensitive areas of your website. It's like giving house keys only to those who really need them.
What SWPanel tools can help you
- Security analysis in Security 360: Detects plugins and themes with known vulnerabilities. Helps you identify problems before anyone else does.
- Security alerts in Security 360: Notifies you when a vulnerability affecting your website is published. It's like having a guard who warns you when there's a problem.
- BotLock: Blocks malicious bots and crawlers. It's like having a doorman who checks who enters your website.
- Web firewall: Filters web attacks before they reach your application. It's like having a wall that protects your house.
- CMS auto-updates: If you installed your website from SWPanel, you can enable automatic updates for WordPress, plugins, and themes. Helps you keep your website secure without worrying about it.
- Backups: If your website gets infected, a recent backup lets you recover it quickly. It's like having a spare key to your house.
- PHP version switch: If your website uses an unsupported PHP version, it won't receive security patches. Switch to a supported version from the hosting panel.
- Ticket support: If you have questions or need help, you can contact us via ticket. We help you solve security issues and keep your website secure.
Quick summary
- The number of critical vulnerabilities in WordPress has increased by 102.2% this week.
- It's important to review installed plugins and themes and keep them updated.
- SWPanel monitors these vulnerabilities and alerts you if they affect your website.
- Use tools like security analysis, firewalls, and backups to protect yourself.
Sources
This week's data comes from public vulnerability catalogs such as CISA KEV, Wordfence, Nuclei, Exploit-DB, Emerging Threats, and EPSS.
