Weekly WordPress vulnerability report: October 26 to November 1, 2026

Every week we go through the WordPress vulnerabilities that received a CVE the week before and sort out which ones deserve your attention first. This report covers October 26 to November 1, 2026.

The short version: make sure every site runs WordPress 7.1.4, released on October 28. It closes a weakness in the update process itself that let an anonymous visitor run code while a core update was in progress, along with eleven other security issues. Then update FunnelKit Automations to 3.8.6.2: Patchstack marks its object injection bug as exploited in the wild, and the plugin had SQL injection without login a week earlier. And if you rely on two-factor login from All-In-One Security or Security Optimizer, update those too: with a stolen password, the second factor could be bypassed in both.

The week in numbers

576 new CVEs were published for WordPress core, plugins and themes last week, almost twice the 300 of the week before. It is the second-biggest week of 2026, after the 750 of October 5 to 11. The median since January 2024 is 194 a week, and 253 in 2026.

• Severity: 57 critical, 165 high, 340 medium and 14 low (CVSS 3.1 base score from the record). 55 of the 57 critical ones need no login.
• Affected: 398 components: 370 plugins, 27 themes and WordPress core. 25 of the themes come from one vendor, ThemeREX.
• Bug types: cross-site scripting leads with 204 records (35%), followed by broken access control (132), PHP object injection (61), information disclosure (37) and SQL injection (32).
• Sources: Patchstack 251, Wordfence 202, WPScan 109, VulnCheck 10, Canva 3, VulDB 1. Wordfence is back to full speed after only 10 records the week before.
• Fixes: of the 482 records for plugins and themes hosted on WordPress.org, 439 already have a newer release than the last affected version, 17 belong to plugins that WordPress.org has closed, 24 have no newer release yet and 2 name no version range. 94 records are for premium plugins and themes, where the version history isn’t public.

Every record, with search and filters, is in our WordPress vulnerability database, which updates daily from the CVE List.

How we rank them

The CVSS score is a starting point, not the answer. We look at who can reach the bug, what has to be switched on for it to work, what the attacker gets and how many sites run the plugin. None of this changes what to do: every fix below should go in as soon as you can. The ranking tells you where to start, and which sites to look at more closely if they ran an old version for a while.

• Highest risk: anyone can reach the bug, the impact is serious and nothing special has to be switched on.
• High risk: it takes an account, an admin action or an unusual trigger, or the impact is narrower.
• Depends on your setup: only exploitable with a specific option, add-on or site type. If your site matches, treat it as highest risk.

Essential Addons for Elementor is this week’s example. A privilege escalation without login, on a plugin with 1,000,000 installs, reads like the week’s biggest emergency. Read the record and it needs open registration plus a role setting that an administrator once saved and later reverted on a page with the plugin’s registration form. Update it on every site anyway: keeping a site safe shouldn’t depend on knowing which conditions apply.

This week’s shortlist

Update everything on this list now. The groups only show where the risk is highest, so you know where to start.

Highest risk

WordPress 7.1.3 and older: the update itself was the opening

Every version from 4.7 to 7.1.3 · CVSS 8.1 · CVE-2026-119977 (Wordfence) · fixed in 7.1.4

During a core update, WordPress unpacks the new version into a working folder under wp-content/upgrade, a place the web server can reach. Up to 7.1.3, that folder had a predictable name. According to the record, that was enough for an anonymous visitor to run code on the server while a full-package core update was in progress. WordPress 7.1.4 (October 28) gives the folder a random name and keeps the upgrade directory from being listed.

The window only opens while an update runs, so this isn’t a hole that stays open around the clock. There is one catch, though. The fix lives in the code that performs the update, and during an update it is the old version’s code that unpacks the new one. So the update to 7.1.4 itself still ran the old way, and the protection covers the updates that come after it. A site that skips 7.1.4 will make its jump to WordPress 7.2, planned for December 8, the old way too.

The same release fixes eleven more security issues, most of them stored cross-site scripting in blocks, the Customizer and the Interactivity API, plus unpublished Customizer changesets that could be found without logging in. Only the update bug has a CVE number so far, which is why this week’s numbers count a single core record. The fixes were backported to every branch down to 4.7, and those releases are out: 7.0.8, 6.9.11, 6.8.12 and so on, back to 4.7.39.

Update now. Most sites installed 7.1.4 on their own, since background updates for minor releases are on by default. Open Dashboard → Updates and check: it should say 7.1.4, or the newest release of your branch.

FunnelKit Automations 3.8.6.1 and older: exploited, and the second fix in a week

20,000+ installs · CVSS 9.8 · CVE-2026-39738 (Patchstack) · fixed in 3.8.6.2 · known to be exploited

FunnelKit Automations runs email automations and abandoned cart recovery for WooCommerce shops, so it handles data from anonymous shoppers by design. Patchstack received a report of PHP object injection without login on October 27, FunnelKit released 3.8.6.2 the next day, and the advisory carries Patchstack’s “Known to be exploited” badge. It was the only plugin this week with that badge and more than 5,000 installs. The changelog line is short: “[Update Recommended] Hardened data validation across abandoned cart capture and contact fields.”

A week earlier, 3.8.6 (October 22) had already fixed a SQL injection without login, listed twice (CVE-2026-111411 from Patchstack, CVE-2026-119163 from Wordfence), and a CSRF rated 8.8 (CVE-2026-111841). According to Wordfence, the SQL injection was planted through an ordinary guest checkout and fired later, when the order changed status.

Update now, to 3.8.6.2 or newer. If the shop ran an older version in the last week, look at the user list for administrators you don’t know.

Project Manager by weDevs 4.1.1 and older: code execution without login

5,000+ installs · CVSS 9.8 · CVE-2026-116512 (Wordfence) · fixed in 4.1.2

A small install base, but nothing to set up and nothing to wait for. According to Wordfence, a value sent to one of the plugin’s REST routes ended up deciding which PHP function ran, and this happened in the input check, which WordPress runs before the route’s permission check. The plugin’s capability check was never reached. 4.1.2 came out on October 29: “Security: Fixed a security issue in how project changes are checked before they are saved. Reported by Wordfence. We recommend updating right away.”

Update now.

High risk

Ultimate Member 2.13.1 and older: object injection without login

200,000+ installs · CVSS 9.8 · CVE-2026-115968 (Patchstack) · fixed in 2.14.0

Reported to Patchstack in early September and fixed in 2.14.0 on September 29, which added its own safe unserialize function: “Fixed: Security issue related to an unauthenticated PHP Object Injection vulnerability.” The same release fixed five more security issues, a privilege escalation among them. Object injection only does damage when the site has code it can chain into, and the advisory doesn’t say whether one exists here, so we rate it high rather than highest. A site that has updated since the end of September already has the fix.

2.14.1 (October 22) fixes another record, a stored XSS for Subscribers through the profile website field (CVE-2026-107625).

Update now, to 2.14.1.

Enable Media Replace 4.1.4 to 4.2.2: a 2023 bug that came back

600,000+ installs · CVSS 7.5 and 8.8 · CVE-2026-114422 (WPScan) and CVE-2026-73186 (Patchstack) · fixed in 4.2.3

When you replace a file, Enable Media Replace goes through the database to update links to it. According to WPScan, data an anonymous visitor managed to store there was unpacked on the way, so a planted payload fired the next time someone with upload rights replaced a file. It can include existing files on the server, and where the attacker can influence a PHP or HTML file there, that ends in code execution. WPScan calls it a regression: the same bug was fixed in 4.1.3 in 2023 and came back in 4.1.4. Patchstack lists a version of it for Subscribers.

4.2.3 (October 26) credits Wordfence, Patchstack and WPScan, and also limits what Authors can do with the plugin, which covers a third record (CVE-2026-85655).

Update now.

PDF Invoices & Packing Slips 5.16.4 and older: a script in a guest order

300,000+ installs · CVSS 7.5 · CVE-2026-111578 (WPScan) and CVE-2026-107750 (Wordfence) · fixed in 5.16.5

Anyone can place a guest order, and the billing name, company and order note end up in the invoice and packing slip. Up to 5.16.4, a script hidden in those fields ran when a shop manager opened the document. Wordfence calls it an incomplete fix: 5.16.2 had added a filter for exactly this, and encoded input slipped past it. 5.16.5 (October 20): “Harden document output and shortcode order access.”

Two days later, 5.16.6 fixed a leak without login (CVE-2026-109217): on shops with the yearly invoice number reset switched on, a guest order placed within a minute of another could receive the other customer’s invoice by email.

Update now, to 5.16.6. A script that runs while a shop manager works acts with that account’s rights.

All-In-One Security and Security Optimizer: a second factor that didn’t hold

All-In-One Security older than 5.5.0 (1,000,000+) and Two Factor Authentication older than 1.17.0 (20,000+) · CVSS 7.5 · CVE-2026-111739 (WPScan)

Security Optimizer older than 1.6.9 (1,000,000+) · CVSS 7.5 · CVE-2026-118185 (WPScan)

Two-factor login exists for the day a password leaks, and both bugs fail exactly then. All-In-One Security and Two Factor Authentication, which share their two-factor code, didn’t tie the code to the account logging in. Someone who knew a victim’s password and had their own account with two-factor on, a Subscriber account for example, could pass the victim’s check with their own code. Both releases from October 26 also stop WooCommerce’s lost password flow from logging a two-factor user in without the code, and All-In-One Security 5.5.0 fixes a way to clear login lockouts without permission.

SiteGround’s Security Optimizer didn’t limit how many codes could be tried for a pending login, so with the password in hand, the code could be guessed. 1.6.9 came out on October 14 with “2FA improvements” in its changelog.

Update now. If an administrator’s password may have leaked, change it as well: on older versions, two-factor wasn’t the backstop it was meant to be.

Widget Options 4.2.5 and older: code execution for Authors

100,000+ installs · CVSS 9.1 · CVE-2026-116852 (Patchstack) · fixed in 4.2.6

According to Patchstack, an Author account was enough to run code through Widget Options. 4.2.6 (October 26): “Resolved Vulnerability to Remote Code Execution”, along with a stored XSS for Contributors. It is the plugin’s second code execution fix this year: 4.2.4 in May closed one for Contributors.

Update now, and remove Author accounts that nobody uses.

BuddyPress 14.5.2 and older: SQL injection for members

90,000+ installs · CVSS 8.5 · CVE-2026-111850 and CVE-2026-115965 (Patchstack) · fixed in 14.5.3

Two SQL injection records for Subscribers. On most sites a Subscriber account is a hurdle, but a community site exists to hand them out. SQL injection lets the attacker read the database, including the user table with its password hashes. 14.5.3 came out on October 22, followed by 14.5.4 the next day.

Update now.

Rank Math SEO 1.0.276 and older: fixed in August, numbered now

4,000,000+ installs · CVSS 8.8 · CVE-2026-1928 (Wordfence) · fixed in 1.0.277

According to Wordfence, a Contributor could plant a PHP object through one of Rank Math’s REST endpoints and, with code the site already had, write a web shell to the uploads folder. The code change the record points to is 1.0.277 from August 26, so sites on the current 1.0.280 are covered. It has nothing to do with the poisoned Rank Math SEO PRO release from two weeks ago: different plugin, different problem.

Update now if a site is still on 1.0.276 or older. With 4,000,000 installs, some are.

25 more ThemeREX themes: reported in February, no fix listed

Premium · CVSS 9.8 · Patchstack · no fixed version listed

Last week it was eleven themes from ThemeREX and axiomthemes. This week Patchstack published PHP object injection records without login for 25 more ThemeREX themes: Avventure, Bonbon, Coinpress, Edge Decor, EmojiNation, Filmax, Gamezone, Gamic, Good Homes, Gunslinger, Legal Stone, Le Truffe, Marcell, Meals & Wheels, Mission, Motorix, Muzicon, Nuts, Orpheus, Ozisti, Preservation, Printy, Quirky, RexCoin and Royal Event. All were reported between February 9 and 20, 2026, and none lists a fixed version. As last week, object injection only does damage when the site has code it can chain into, which is hard to predict on themes that bundle several plugins.

Update now if ThemeForest has a newer version than the affected one. If not, ask the vendor. If one of these themes is installed but not in use, delete it.

Depends on your setup

These need a particular setup before they can be exploited. Update them now all the same. The condition tells you whether a site that ran an old version deserves a closer look.

Avada: the upload field in Avada forms

Premium theme · CVSS 8.1 · CVE-2026-115346 (Wordfence) · fixed in 7.16.4

Wordfence lists a file upload without login through the upload field of Avada’s own forms, with too little checking of the file type, which can lead to code execution. The record’s range ends at 7.16.2, but Avada’s announcement puts the fix in 7.16.4, released on October 27 with thanks to Wordfence: “Fixed a possible remote code execution vulnerability in Avada Forms upload fields.” 7.16.3, a week earlier, fixed two other issues, a stored XSS for Contributors in form fields and missing authorization in a legacy migration routine. The sites exposed are the ones with a published Avada form that accepts files.

Update now, to 7.16.4 or newer, through Avada’s own updater. Avada was on our list three weeks ago too.

Formidable Forms 6.35 and older: plugin installation for whoever can see the forms list

300,000+ installs · CVSS 8.8 · CVE-2026-89435 (Wordfence) · fixed in 7.0

Formidable’s add-on installer was protected by a token, and according to Wordfence, any logged-in user allowed to view the forms list could get that token. Combined with a download address check that was too loose, that was enough to install any plugin, which means running one’s own code on the server. It only works on sites without Formidable Pro. By default only administrators see the forms list, so the sites exposed are the ones that gave the View Forms List permission to other roles.

7.0 came out on October 16: “Additional permission checks have been added to prevent unauthorized plugin installations.”

Update now. If roles below administrator have View Forms List, look through the plugin list for anything nobody remembers installing.

Gravity Forms 3.1.2 and older: List fields in forms that create posts

Premium · CVSS 9.8 · CVE-2026-103039 (Wordfence) · fixed in 3.1.3

Gravity Forms can turn a submission into a post. When such a form has a Post Custom Field with the List input type and a content template, the submitted value went through WordPress’s general unserialize function instead of the hardened one Gravity Forms added in 3.1.1, so anyone who could submit the form could plant a PHP object. Gravity Forms has no chain of its own; according to Wordfence, one particular field mapping lets WordPress supply one, on servers with an unusual PHP setup. 3.1.3 came out on October 1 with “security enhancements”.

Update now.

Wp Social, Jupiter X Core and Qode Membership: social logins that trusted the wrong account

Three plugins, the same result: with Facebook or X login in use, an anonymous visitor could end up logged in as someone else, administrators included.

Wp Social Login and Register Social Counter 3.2.2 and older · 70,000+ installs · CVSS 8.1 · CVE-2026-103898 (Wordfence) · fixed in 3.2.3

The plugin found the WordPress account by the email address the social network returned, and its check that the address was verified did nothing for Facebook and X. A social account carrying someone else’s address logged in as that person. 3.2.3 (October 18): “Fixed: Authentication bypass vulnerability via insufficient email verification in social login callback.”

Jupiter X Core 4.61.0 and older · 70,000+ installs · CVSS 9.8 · CVE-2026-106013 (Wordfence) · fixed in 4.62.0

With X login set up in Jupiter X forms, the plugin asked X for the profile of the account behind the site’s own X app instead of the visitor’s, then logged the visitor into the WordPress account with that email address. That is usually the site owner’s account. 4.62.0 came out on October 22 with “Fixed Security issue.”

Qode Membership 2.0.6.2 and older · premium, bundled with Qode themes such as Bridge · CVSS 9.8 · CVE-2026-92885 (Wordfence) · no fixed version listed

A typo in a variable name switched off the Facebook token check, so a request naming an existing username logged in as that user. The only thing it needs is a public page with the plugin’s login or register shortcode.

Update now. For Qode Membership, check whether your theme ships a newer version, and if the site doesn’t use its social login, deactivate the plugin until it does. On any of the three, look through the administrator list.

Essential Addons for Elementor 6.8.7 and older: an Editor account through a reverted setting

1,000,000+ installs · CVSS 7.4 · CVE-2026-118205 (Wordfence) · fixed in 6.8.8

Essential Addons’ Login | Register Form widget lets the page decide which role new users get. According to Wordfence, an anonymous visitor could register with a role as high as Editor by pointing the form at an old revision of the page, if “Anyone can register” is on and an administrator once saved a higher role there and later changed it back. The revision kept the old setting, and the plugin accepted it. Two smaller records are fixed too: accounts registered through the email code flow skipped the administrator approval step (CVE-2026-110508, fixed in 6.8.7), and an Author could escalate their role (CVE-2026-110808). 6.8.8 came out on October 28, with no security line in its changelog.

Update now. Last week’s 6.8.6 isn’t enough anymore. If registration is open, check recent sign-ups for Editors.

AI Engine 3.8.6 and older: one approval away from an admin token

90,000+ installs · CVSS 7.5 · CVE-2026-110732 (Wordfence) · fixed in 3.8.7

AI Engine’s MCP module lets AI assistants work on the site, and assistants connect through OAuth. Its client registration endpoint accepted anyone, so an attacker could register a client of their own and receive an administrator-level token as soon as an administrator approved it on the consent screen. That screen could be loaded inside another page, so the approval could be obtained by tricking an administrator into a click. Only sites that use the MCP module are affected. 3.8.9 (October 31) fixes a CSRF rated 8.8 (CVE-2026-65566).

Update now, to 3.8.9 or newer, and check the MCP tab for connected clients you don’t recognize.

Ad Inserter 2.8.19 and older: shortcodes from the search box

300,000+ installs · CVSS 6.5 · CVE-2026-102905 (Wordfence) and 4 more · fixed in 2.8.20

Ad blocks can contain dynamic tags such as {title}, {category} or {smart-tag}. According to Wordfence, on search pages the visitor’s search phrase could reach a shortcode call through these tags, so anyone could run any shortcode the site has. It takes an ad block with a dynamic tag that is shown on search pages, which Wordfence calls “a normal and documented plugin configuration”. 2.8.20 (October 28) fixes it together with four cross-site scripting bugs, one of them without login (CVE-2026-105077).

Update now.

Comment scripts, week four

Twelve more records share the cause we have followed for four weeks: a plugin reworks a visitor’s comment or the finished page and breaks the escaping that kept the comment harmless. All need no login and a published comment, and most need a particular setting.

• NextGEN Gallery 4.5.4 and older (300,000+): only with Shutter or Shutter Reloaded as the lightbox (CVE-2026-116563). Fixed in 4.5.5.
• Relevanssi 4.28.5 and older (100,000+): only with comment indexing and comment highlighting both on, and the script runs when someone opens a search result link (CVE-2026-116522). Fixed in 4.28.6.
• Prime Slider 4.7.2 and older (100,000+): the plugin’s own content filter undid WordPress’s sanitizing (CVE-2026-111111). Fixed in 4.7.3.
• Greenshift 13.2.1 and older (70,000+): two records through its Latest Comments and Split Text blocks (CVE-2026-107627 and CVE-2026-107629). Fixed in 13.2.2.
• ThirstyAffiliates 3.12.1 and older (30,000+): only on block themes, by a commenter who already has one approved comment (CVE-2026-119089). Fixed in 3.12.2.
• Advanced Views 3.9.6 and older (2,000+): CVE-2026-109995. Fixed in 3.9.7.
• Schema App Structured Data and DSGVO All in one for WP: both closed on WordPress.org, no fix (CVE-2026-96666 and CVE-2026-96741). Remove them.
• W3 Total Cache and LiteSpeed Cache have three more records between them, all covered by last week’s fixes. See below.

Update now, and if a site ran one of these with open comments, look through recent comments for strange markup.

Back from last week

Several plugins from last week’s report got new records this week. If you followed last week’s advice:

• W3 Total Cache: last week we read the code and guessed that the bug was in HTML minify, since the advisory gave no details. Wordfence now publishes it the same way (CVE-2026-120019), plus a second record for sites whose Pro license lapsed with REST caching on (CVE-2026-111254). 2.11.0 covers both. Nothing more to do.
• LiteSpeed Cache 7.9.2 also covers two new records: one with HTML Minify on and another plugin printing comments into structured data (CVE-2026-116763), and a stored XSS for Subscribers (CVE-2026-109215). Nothing more to do.
• Ninja Forms 3.15.6 covers all five new records, among them a shortcode execution without login (CVE-2026-100155). Nothing more to do.
• Royal Elementor Addons: eight new records, four of them without login, need 1.7.1070 (October 23), so last week’s 1.7.1069 isn’t enough.
• Profile Builder: 4.0.5 isn’t enough anymore. 4.0.6 (October 29) fixes three records, among them an XSS without login (CVE-2026-54855) and a privilege escalation for Contributors (CVE-2026-54854).
• LearnPress: 4.4.11 isn’t enough anymore. 4.4.12 fixes three access control records, one of them without login (CVE-2026-115599), and 4.4.13 another security issue.
• GiveWP: 4.19.0.1 isn’t enough anymore. An access control bug without login (CVE-2026-116853) is fixed in 4.19.0.2.
• Essential Addons for Elementor: go to 6.8.8. See above.
• Uncanny Toolkit for LearnDash: 3.8.2 isn’t enough anymore. With a valid password, an account still waiting for approval or suspended by an administrator could log in (CVE-2026-119096), fixed in 3.8.3.
• Amelia: two more records, a staff data leak without login (CVE-2026-103915) and an XSS for logged-in users. The current version, 2.4.14 (October 27), is another security release. If you went to the current version last week, update again.
• Newsletters: last week’s 4.18.2 has a new CSRF record rated 9.6 (CVE-2026-116863) with no fix yet. If you can, deactivate it until a new release appears.
• WP User Manager needs 2.10.0 for an access control record without login (CVE-2026-116846), Royal MCP needs 1.5.10 and Strong Testimonials 3.3.16.

Also on the list

Smaller install bases or narrower conditions, but if you run one of these, update it too.

• All in One SEO 5.0.3 and older (2,000,000+): private custom field values could be pulled into the title and schema of the search results page without login (CVE-2026-109367). Fixed in 5.0.4.
• Spectra 2.20.4 and older (1,000,000+): limited deletion and changes of theme files without login (CVE-2026-92294). Fixed in 2.20.5 on October 9.
• The Events Calendar 6.18.2 and older (600,000+): four records, one of them an access control bug without login (CVE-2026-119368). Fixed in 6.18.3.
• Popup Builder 4.4.5 and older (200,000+): a single anonymous request could move every published popup to the trash (CVE-2026-89270). Fixed in 4.4.6, which also fixes a stored XSS through the subscription form.
• HUSKY 1.4.6 and older (80,000+): access control bug without login (CVE-2026-116401). Fixed in 1.4.7.
• Export and Import Users and Customers 2.7.5 and older (50,000+): a Subscriber’s crafted profile bio became a new user with a role of their choice when an administrator exported and re-imported users (CVE-2026-104368). Fixed in 2.7.6.
• InstaWP Connect 0.1.4.2 and older (40,000+): CSRF rated 8.8 (CVE-2026-116399). Fixed in 0.1.4.3.
• Logs that run visitor input: Shield Security 22.3.2 and older (30,000+) stored a script from the request address in its traffic log, and WP Visitor Statistics before 8.8 (20,000+) one from tracking data. Both ran when an administrator opened the log (CVE-2026-118057 and CVE-2026-117571). Fixed in 22.3.4 and 8.8.
• User Frontend 4.3.13 and older (20,000+): privilege escalation for Subscribers (CVE-2026-120070). Fixed in 4.3.14.
• SQL injection without login: the Newsmatic theme 1.5.0 and older (10,000+, CVE-2026-110184; no fixed version listed, the current release is 1.5.2) and Motors 1.4.126 and older (9,000+, CVE-2026-115964, fixed in 1.4.127).
• File uploads that put code on the server: Checkout Files Upload for WooCommerce older than 2.4.0 (7,000+, no login, when the accepted file types setting was left empty, which the plugin documented as “accept all files”, CVE-2026-103688, fixed in 2.4.0) and Pie Register Premium 3.8.4.0 and older (no login, CVE-2026-84999, no fixed version listed).
• VikRentCar 1.4.10 and older (4,000+): seven records, and Patchstack marks one of them, an XSS without login (CVE-2026-28160), as exploited. All fixed in 1.4.11.
• Zoho Flow 2.14.5 and older (5,000+): PHP object injection without login (CVE-2026-62131), fixed in 2.14.6. SMS Alert Order Notifications 4.0.2 and older (3,000+): privilege escalation without login (CVE-2026-116386), fixed in 4.0.3.

What to do now

1. Open Dashboard → Updates on every site and make sure WordPress is on 7.1.4, or the newest release of its branch. Do it before WordPress 7.2 arrives on December 8.
2. Install the plugin updates, starting with FunnelKit Automations (3.8.6.2) and Project Manager (4.1.2).
3. If you use two-factor login from All-In-One Security, Two Factor Authentication or Security Optimizer, update them, and change any administrator password that may have leaked.
4. Update Avada to 7.16.4 through its own updater, and check ThemeForest for the ThemeREX themes listed above. Delete themes you don’t use.
5. On sites with open registration or social login, look through the user list for administrators and Editors you don’t know.

Where Must-Have Security fits

Updates close the holes on this list, and next week brings a new one. Several of this week’s bugs end in code on the server: Project Manager runs it for anyone, Widget Options for an Author and Rank Math for a Contributor, Formidable installs a plugin, and Avada and Checkout Files Upload accept uploaded files. The social login and two-factor bugs hand over administrator sessions, and an attacker with an administrator session usually goes on to install a plugin or edit a file. All of that means writing executable code to the server.

How this report is made

We take every CVE record for WordPress core, plugins and themes published in the CVE List between Monday and Sunday (UTC), as collected in our database. Install counts are from WordPress.org. Fixed versions come from the advisory, the plugin’s changelog or the code change itself, and where they disagree, we go with the code. The screenshots were taken on a local test site running the affected versions. The ratings are ours.

The next report covers November 2 to 8 and comes out on Monday, November 9.