Vulnerabilities in WordPress: what you need to know this week

This week, what you need to know

This week, 166 new critical vulnerabilities have been identified in WordPress plugins and themes. Although the number is high, it is 8.8% less than last week and remains below the average of the last 5 weeks. If you have a website with WordPress, it's important to know that these flaws could allow attackers to take control of your site, steal data, or even execute commands as if they were you. Don't worry: with a bit of attention, you can easily protect yourself.

What's happening in the world

SWPanel constantly monitors public vulnerability catalogs to stay aware of risks affecting WordPress. This week, 504 new vulnerability entries have been added, of which 166 are considered critical. This means there are 166 new ways an attacker could exploit a WordPress plugin or theme if they are not updated.

The number of critical vulnerabilities has fluctuated in recent weeks: there was a peak of 284 the week of October 13–17, and a minimum of 90 the week of October 20–24. This week, with 166 critical vulnerabilities, it has remained below the average of the last 5 weeks (186), and the overall trend is downward.

The entries, CVE by CVE

Below, we explain some of the most critical vulnerabilities identified this week:

CVE-2026-119075

• Affected product: Plugin *Registration Form for WooCommerce* <= 1.1.4
• What it is: A flaw that allows an attacker to change user permissions without needing to be authenticated.
• How it is exploited: An attacker could exploit this flaw to escalate their privileges and become an administrator of the site.
• What it can cause: Unauthorized access to restricted features, such as user management or site configuration.
• Severity (CVSS): 9.8 (very critical)
• Likelihood of use (EPSS): High
• Is it being exploited?: No information on active exploitation.

CVE-2026-113616

• Affected product: Plugin *LogixFast Auth* <= 1.0.3
• What it is: A flaw that allows an attacker to take control of an account without needing to be authenticated.
• How it is exploited: The attacker could create an account with the same privileges as an existing user.
• What it can cause: Identity theft, unauthorized access to restricted features.
• Severity (CVSS): 9.8
• Likelihood of use (EPSS): High
• Is it being exploited?: No information on active exploitation.

CVE-2026-86596

• Affected product: Plugin *s2Member* <= 260927
• What it is: A flaw that allows malicious code execution from an input parameter.
• How it is exploited: An attacker could send a malicious request that executes code on the server.
• What it can cause: Arbitrary command execution, which could allow the attacker to take control of the site.
• Severity (CVSS): 9.8
• Likelihood of use (EPSS): High
• Is it being exploited?: No information on active exploitation.

CVE-2026-93754

• Affected product: Plugin *payever – WooCommerce Gateway* <= 4.8.0
• What it is: A flaw that allows arbitrary file upload, which could lead to malicious code execution.
• How it is exploited: An attacker could upload a malicious file and execute it on the server.
• What it can cause: Arbitrary code execution, which could allow the attacker to take control of the site.
• Severity (CVSS): 9.8
• Likelihood of use (EPSS): High
• Is it being exploited?: No information on active exploitation.

CVE-2026-104014

• Affected product: Plugin *Naimur Email OTP Verification for WooCommerce* <= 2.1.0
• What it is: A flaw that allows unauthorized access to accounts using abandoned passwords.
• How it is exploited: An attacker could exploit an abandoned password to log in as if they were the legitimate user.
• What it can cause: Identity theft, unauthorized access to restricted features.
• Severity (CVSS): 9.8
• Likelihood of use (EPSS): High
• Is it being exploited?: No information on active exploitation.

How we got here

The evolution of critical vulnerabilities in WordPress has been fluctuating in recent weeks:

• 29/09 to 03/10: 132 critical vulnerabilities
• 06/10 to 10/10: 240 critical vulnerabilities (+81.8%)
• 13/10 to 17/10: 284 critical vulnerabilities (+18.3%)
• 20/10 to 24/10: 90 critical vulnerabilities (-68.3%)
• 27/10 to 02/11: 182 critical vulnerabilities (+102.2%)
• 03/11 to 08/11 (this week): 166 critical vulnerabilities (-8.8%)

The average of the last 5 weeks is 186 critical vulnerabilities, and this week it is at 166, which is 10.6% less than the average. The maximum recorded was 284 vulnerabilities, and the minimum was 90. The overall trend is downward, and the linear projection suggests we could see around 163 critical vulnerabilities next week, which is 2.1% less than this week.

What's happening behind the numbers

These data reflect the activity of developers and security experts who identify and report flaws in WordPress plugins and themes. Although the number of vulnerabilities may seem high, most of them are resolved with updates. What we see is a downward trend, which suggests that developers are responding quickly to reported issues.

One possible interpretation is that developers are improving their security processes and responding faster to reported flaws. It's also possible that there are fewer new plugins with critical flaws this week, which would explain the decrease.

What we can expect

If the current trend continues, it's likely that in the next 2–4 weeks we will see between 160 and 170 critical vulnerabilities per week. This would be an optimistic scenario, as it means developers are continuing to resolve issues quickly.

A pessimistic scenario would be if new attack patterns are detected or if critical flaws are identified in very popular plugins. In that case, we could see an increase in the number of reported vulnerabilities.

Warning signs to watch for:

• A sudden increase in the number of critical vulnerabilities.
• The appearance of flaws with active exploitation (KEV = S).
• An increase in the number of plugins with unsupported versions.

How it can affect your website or business

Imagine you have an online store with WordPress and you're using a plugin that is not updated. An attacker could exploit one of these vulnerabilities to:

• Take control of your site: If the attacker gains access, they could change your website's content, steal customer data, or even take your site offline.
• Steal customer data: If the attacker has access to the database, they could steal addresses, emails, credit card numbers, etc.
• Damage your reputation: If your site is filled with pharmacy ads or becomes a malware distribution point, Google could mark it as dangerous, and you could lose customers.

This could mean financial losses, fines for GDPR non-compliance, and a loss of trust in your brand.

How to protect yourself and prevent attacks

1. Update your plugins and themes regularly: Updates usually include patches for the latest flaws. If you use plugins installed from SWPanel, you can enable automatic updates from the panel.
2. Use strong and unique passwords: A weak or reused password can be easily guessed or stolen. Use a password generator and avoid reusing passwords.
3. Enable two-factor authentication (2FA): 2FA adds an extra layer of security, making it harder for an attacker to access your account even if they have your password.
4. Use a web application firewall: A web firewall filters malicious requests before they reach your application. You can enable it from the hosting panel if you're using SWPanel.
5. Review user permissions: Make sure only the necessary users have access to critical features. If a user no longer needs access, revoke it.
6. Use security plugins: Plugins like Wordfence or iThemes Security can help you detect and block attack attempts.
7. Make regular backups: In case your site is compromised, a recent backup will allow you to restore it quickly.
8. Keep WordPress updated: Make sure WordPress is updated to the latest stable version. Updates usually include patches for the latest flaws.
9. Use a vulnerability detection service: The website security analysis in Seguridad 360 can detect CMS, plugins, and versions with known flaws and mark your site in the panel.
10. Monitor security alerts: Subscribe to the Newsletter and security alerts from Seguridad 360 to receive notifications when new flaws that could affect you are released.

What SWPanel tools can help you

• Website security analysis in Seguridad 360: Detects CMS, plugins, and versions with known flaws and marks your site in the panel.
• Newsletter and security alerts in Seguridad 360: Warn you when a flaw that affects you is released.
• BotLock: Controls and blocks malicious bots and crawlers from your site.
• FireWall: Filters web attacks before they reach your application.
• Automatic CMS updates: If you installed your site from SWPanel, you can enable automatic updates to keep your WordPress updated.
• Backups: Allow you to restore your site in case it is compromised.
• PHP version change: If you're using an unsupported version, you can switch to a supported version from the hosting service.
• Ticket support: If you have questions or need help, you can contact our technical support.

Quick summary

• This week, 166 new critical vulnerabilities in WordPress plugins and themes have been identified.
• The overall trend is downward, and the projection suggests we could see around 163 vulnerabilities next week.
• Plugin and theme updates, along with good security practices, are key to protecting your site.

Sources

The data for this week come from public vulnerability catalogs such as CISA KEV, Wordfence, Nuclei, Exploit-DB, Emerging Threats, and EPSS.