Weekly WordPress vulnerability report: October 5 to 11, 2026

Every Monday we go through the WordPress vulnerabilities that received a CVE the week before and sort out which ones deserve your attention first. This report covers October 5 to 11, 2026.

The short version: if you run The Events Calendar, Forminator, GiveWP or LatePoint, update them today. Each has a bug that needs no account, all four sit on 100,000 sites or more, and fixed versions are out for every one of them. If you build with Avada and use its forms, the same goes for Avada 7.16.2. WordPress itself had a security release too, so check that your sites are on 7.1.3. Everything else on the list should be updated as soon as you can as well: fixed versions are out for nearly all of it.

The week in numbers

751 new CVEs were published for WordPress core, plugins and themes last week. That is the busiest week in our database, which goes back to January 2024. The previous high was 590, a typical week brings around 190, and the week before this one brought 463. Saturday, October 10 alone accounted for 281 records, 160 of them from Patchstack and 105 from Wordfence.

• Severity: 115 critical, 347 high, 272 medium and 17 low (CVSS 3.1 base score from the record).
• Affected: 601 components: 505 plugins, 95 themes and WordPress core.
• Bug types: cross-site scripting leads again with 231 records (31%), followed by broken access control (142), PHP object injection (78) and SQL injection (76).
• Sources: Patchstack 477, WPScan 152, Wordfence 117, VulnCheck 3, Tenable 2.
• Fixes: of the 507 records for plugins and themes hosted on WordPress.org, 383 already have a newer release than the last affected version and 26 belong to plugins that WordPress.org has closed. The other 98 have no newer release yet, a much larger share than last week. 242 records are for premium plugins and themes, where the version history isn’t public.

Premium themes account for a good part of the jump. 49 records describe PHP object injection in commercial themes: 45 of them are rated critical, 46 need no login, and almost all came out on Saturday. 36 are for themes by ThemeREX. Only one of the 49 names a fixed version.

Object injection comes up several times below, so here is what it means. The attacker gets the code to turn text they control into a PHP object. That alone does nothing. The damage comes from code already on the site, in any plugin or theme, that runs automatically when such an object is created or thrown away. If a suitable piece of code is installed, the result ranges from deleted files to the attacker running their own code. The 9.8 scores assume the worst combination of plugins. On a given site the bug may be harmless or may be a takeover, and from the outside you can’t easily tell which.

If a site runs a theme bought on ThemeForest, check the author under Appearance → Themes → Theme Details, then look for a release from the last few weeks in the vendor’s changelog.

Every record, with search and filters, is in our WordPress vulnerability database, which updates daily from the CVE List.

How we rank them

The CVSS score is a starting point, not the answer: whoever publishes the record sets it, and it describes the bug in the abstract. We look at four things instead: who can reach the bug, what has to be switched on for it to work, what the attacker gets, and how many sites run the plugin. None of this changes what to do: every fix below should go in as soon as you can. The ranking tells you where to start, and which sites to look at more closely if they ran an old version for a while. That gives three groups:

• Highest risk: anyone can reach the bug, the impact is serious and the plugin is popular.
• High risk: it takes an account, an admin action or a particular role, or the impact is narrower.
• Depends on your setup: only exploitable with a specific plugin, server or option. If your site matches, treat it as highest risk.

Blocksy Companion is this week’s example. Its record says “unauthenticated privilege escalation” and scores 9.1. Read on and the attacker gets a marketplace vendor account, and only on sites that also run Dokan. That is a real problem for a Dokan marketplace and harmless elsewhere. Update it on every site anyway: keeping a site safe shouldn’t depend on knowing which conditions apply.

This week’s shortlist

Update everything on this list now. The groups only show where the risk is highest, so you know where to start.

Highest risk

The Events Calendar 6.17.4 and older: object injection without logging in

600,000+ installs · CVSS 9.8 · CVE-2026-95606 (Patchstack) · fixed in 6.17.4.1

Patchstack lists it as PHP object injection that anyone can reach, no account needed. The fix came in 6.17.4.1 on September 10, with a single changelog line: “Strengthened validation of copied widget instances”. It is the third round on the same widget copy and paste code: 6.17.3 added the check and 6.17.3.1 made it stricter before this release closed the gap for good.

Event calendars often run on sites that get little attention once the season’s program is up: clubs, venues, community groups. Those are exactly the sites where an update waits for weeks.

Update now. The current release is 6.18.0.

Forminator 1.57.3 and older: six bugs, none needs a login

600,000+ installs · 6 CVEs · worst: CVSS 8.2, CVE-2026-96341 (Patchstack) · fixed in 1.58.0

Patchstack published six Forminator records this week, all reachable without an account: privilege escalation (8.2), deletion of arbitrary content (CVE-2026-65459, 7.5), a payment bypass (CVE-2026-96336, 7.5), broken access control (CVE-2026-96335, 7.5), stored cross-site scripting (CVE-2026-102388, 7.1) and cross-site request forgery (CVE-2026-106611, 7.1). The advisories give no details, and the changelog says only “Security improvements” for 1.57.2.1 and 1.57.3.1. The code changes in those releases touch the user registration forms, saved form drafts and submission handling.

If you take payments or donations through a Forminator form, compare recent paid submissions with your Stripe or PayPal dashboard after updating.

Update now. 1.58.0 covers all six.

GiveWP 4.17.0 and older: back for a second week

100,000+ installs · CVSS 8.1 · CVE-2026-104405 (Patchstack) · fixed in 4.18.0

Last week we told GiveWP users to update to 4.17.0. That is no longer enough. Patchstack now lists a privilege escalation in 4.17.0 and older that needs no login. Its score assumes high attack complexity, meaning something outside the attacker’s control has to line up, but the impact is complete when it does. The same release fixes a stored XSS that needs no login (CVE-2026-104672, 7.1) and a Contributor-level XSS in the campaign grid shortcode (CVE-2026-97643).

The 4.18.0 changelog (October 1) lists security work on the Stripe webhook module, the campaign block and access to the Donor Dashboard. Five days later, 4.18.0.1 added a missing authorization check to PayPal Standard IPN handling (CVE-2026-106600, 5.3).

Update now, straight to 4.18.0.1.

LatePoint 5.7.2 and older: SQL injection through the booking form

100,000+ installs · CVSS 7.5 · CVE-2026-96662 (Wordfence) · fixed in 5.7.3

An anonymous visitor can inject SQL through the booking[service_id] parameter, which the public booking form sends. The booking form is open to everyone by design, so nothing stands in front of the bug. Through it the attacker can read the database: customer names, email addresses and phone numbers from the bookings, and the password hashes of WordPress users.

Three more LatePoint records came out this week. A user with a LatePoint role that can edit settings can set the default WordPress role for new customers to administrator (CVE-2026-104766, 8.8, fixed in 5.7.4). Two Subscriber-level bugs let logged-in customers change other customers’ details or attach bookings to someone else’s order (CVE-2026-17538 and CVE-2026-91050).

LatePoint was in last week’s report too, with a shortcode bug fixed in 5.7.1. The changelogs of 5.7.3 and 5.7.4 both read “Addressed security bugs. Props to WordFence for reporting it.”

Update now. 5.7.4 is outside the affected range of all four records.

Avada 7.16.1 and older: an anonymous form submission can trigger WordPress actions

Premium · CVSS 9.1 · CVE-2026-97670 (Wordfence) · fixed in 7.16.2

Avada is a premium theme with its own builder plugin, so it doesn’t appear in WordPress.org install counts, but it runs on a very large number of sites. The bug is in Avada Forms: through a form submission, an anonymous visitor can make the site run WordPress actions of their choosing. In Wordfence’s test this permanently deleted everything in the trash: posts, pages and comments. Other actions can slow down or break the site, and plugins that do something risky on an action widen the impact further.

The condition is a published Avada form with AJAX submission whose notification email includes the submitted fields, which according to the record is the default form setup. Avada 7.16.2, released September 30, fixes it along with five other security issues, among them a Subscriber-level stored XSS through user profile fields (CVE-2026-97340).

Update now, above all if the site has an Avada form. Avada updates come through its own registration rather than WordPress.org, so they are easy to miss. Update the theme and the Avada Core and Avada Builder plugins together.

High risk

MainWP Child 6.2.1 and older: object injection in clone and restore

700,000+ installs · CVSS 8.8 · CVE-2026-105436 (Patchstack) · fixed in 6.2.2

Patchstack says no login is needed, but its score also requires user interaction: someone on the site has to do something before the bug fires. The 6.2.2 changelog (October 5) narrows it down: “Hardened serialized data handling during Clone/Restore operations.” So the exposure is in cloning a site or restoring a backup, not in everyday traffic.

Update now. If you manage sites with MainWP, the dashboard updates every child site in one go.

String Locator before 2.6.8: planted by a visitor, triggered by an admin

100,000+ installs · CVSS 8.8 · CVE-2026-97188 (WPScan) · fixed in 2.6.8

According to WPScan, an anonymous visitor can get a serialized PHP object into the database, and it comes alive when an administrator later opens and saves that row in String Locator’s database editor. Nothing happens without that admin step, which keeps the risk moderate.

Update now. String Locator is the kind of plugin people install for one search and then forget. If nobody uses it, delete it.

WooCommerce 9.8.0 to 11.1.2: from shop manager to administrator

7,000,000+ installs · CVSS 7.2 · CVE-2026-106608 (Patchstack) · fixed in 11.2.0

Shop managers are allowed to edit customer accounts. Before 11.2.0 that also covered accounts holding a second role that a shop manager shouldn’t touch, administrator included. Editing an account means setting its email address and password, so a shop manager could take such an account over. The 11.2.0 changelog (October 7) has the fix: “Prevent shop managers from editing users who have additional roles that cannot be edited by shop managers.”

Update now. The bug bites where someone holds the Shop Manager role and some accounts have more than one role, which role editor and membership plugins make possible. On stores where staff, freelancers or an agency manage orders, also check who has that role.

WordPress 7.1.3: seven security fixes

Every site · CVSS 6.9 · CVE-2026-66666 (Patchstack) · fixed in 7.1.3

The week’s one core CVE: anonymous visitors could read comments on private and unpublished posts through the comment feed. WordPress 7.1.3 (October 6) fixes six more issues that haven’t received a CVE, including a stored XSS on the Comments screen through pending comments and a second-order SQL injection in the export tool. Older branches get the same fixes as backports, such as 7.0.7 and 6.9.10.

Update now. Most sites install minor releases automatically, so check that Dashboard → Updates shows 7.1.3, or the latest release of your branch.

Depends on your setup

These three need a particular setup before they can be exploited. Update them now all the same. The condition tells you whether a site that ran an old version deserves a closer look.

Blocksy Companion 2.1.58 and older: only with Dokan

300,000+ installs · CVSS 9.1 · CVE-2026-107645 (Wordfence) · fixed in 2.1.59

Blocksy’s login and registration popup switched off Dokan’s own check on vendor sign-ups and accepted whatever role the visitor sent. On a site running Dokan, the multi-vendor marketplace plugin, anyone could register as a vendor and be logged in straight away, even with vendor sign-up turned off. Vendors can publish products and get more access than customers. According to the 2.1.59 changelog (October 8), the account popup now respects Dokan’s vendor registration setting.

Update now. Without Dokan the bug has no effect. With Dokan, also look through recently registered vendors.

BackWPup 5.7.6 and older: backups left in the open on NGINX

400,000+ installs · CVSS 5.9 · CVE-2026-86826 (WPScan) · fixed in 5.7.7

When a restore is interrupted, BackWPup leaves its working directory behind with the full backup archive inside: the database dump and the site files, wp-config.php included. On Apache, .htaccess rules keep that directory private. NGINX ignores those rules, and the directory name was predictable, so anyone could download the archive. 5.7.7 (October 5) gives restore directories unpredictable names and cleans up abandoned restore files automatically.

The same release fixes two more bugs: anonymous visitors could start any existing backup job through wp-cron.php (CVE-2026-86827), and administrators could write files outside the restore folder (CVE-2026-86828).

Update now. 5.7.7 also removes restore files that older versions left behind, which matters most on NGINX.

Redux Framework 4.5.11 and older: subscriber to admin, if your theme uses its profile fields

900,000+ installs · CVSS 6.8 · CVE-2025-14123 (Wordfence) · fixed in 4.5.13

A subscriber can give themselves any role, administrator included, but only when a theme or plugin built on Redux adds fields to the user profile through Redux’s Users extension. The fix shipped back in June in 4.5.13, and the CVE was published only now. The current 4.5.15 fixes two more Redux bugs from September.

Update now. If Redux appears in the plugin list, check its version. Many themes bundle their own copy of Redux, and only a theme update replaces that.

Back from last week

Several plugins from last week’s report got new records this week. If you followed last week’s advice:

• Kirki 6.3.2 also fixes two new bugs that need no login: stored XSS through registration fields (CVE-2026-102173) and shortcode execution through a comments collection (CVE-2026-84220). Nothing more to do.
• Ultimate Member 2.14.0 covers one more privilege escalation record (CVE-2026-96539). Nothing more to do.
• Unlimited Elements for Elementor: 2.0.21 covers a Contributor-level object injection (CVE-2026-95534), but a broken access control fix (CVE-2026-105064) needs 2.0.23.
• WP 2FA: last week’s 4.1.0 isn’t enough anymore. 4.2.0 fixes a cross-site request forgery in its REST request handling (CVE-2026-62142, 8.8).
• GiveWP and LatePoint need newer versions, see above.

Also on the list

Smaller install bases or narrower conditions, but if you run one of these, update it too.

• PPOM for WooCommerce 34.0.10 and older (20,000+): anyone can move files on the server, wp-config.php included, into a public folder, which deletes them from their place and exposes their contents. CVSS 9.1. Fixed in 34.0.11.
• Booster for WooCommerce 8.4.0 and older (30,000+): PHP object injection without login, 9.8. Fixed in 8.5.0.
• Easy Digital Downloads 3.7.1 and older (40,000+): broken access control without login (7.5), plus account creation while registration is switched off and stored XSS through PayPal IPN data in earlier versions. 3.7.1.1 covers all three.
• Amelia 2.4.10 and older (90,000+): broken access control without login, 7.5. Fixed in 2.4.11.
• Bricksforge (premium, 3.1.8.9 and older): a file upload that ends in code execution, no login needed (CVE-2026-85097, 9.8). Version 4.0.1 (October 8) fixes a further Pro Forms upload issue that hasn’t been disclosed yet, so go straight to 4.0.1.
• Meta Box AIO (premium, 3.7.1 and older): privilege escalation without login, 9.8. The record names no fixed version, so check with the vendor.
• Super Forms (premium, 6.3.316 and older), again: anyone can delete directories on the server, the WordPress folder included, when “Delete files from server after form submissions” is on (CVE-2026-17609, 9.1). No fixed version listed.
• Jetpack 16.2 and older (3,000,000+): two medium-rated bugs around password recovery, no login needed but rated high complexity. Fixed in 16.3, whose changelog mentions improved login verification in Account Protection.
• Rank Math before 1.0.280 (4,000,000+): three bugs that all need an administrator account, the worst a file upload to code execution through settings import. Fixed in 1.0.280.

And four popular plugins whose current release is still inside the affected range. Watch for an update and install it the day it arrives:

• Dynamic Text Extension for Contact Form 7 (DTX) 5.0.7 (100,000+): sensitive data exposure without login, 7.5.
• Photo Gallery by 10Web 1.8.47, Sassy Social Share 3.3.79 (100,000+ each) and Kubio AI Page Builder 2.9.3 (80,000+): cross-site scripting without login, 7.1. These need someone, ideally a logged-in admin, to open a crafted link or page.

What to do now

1. Open Dashboard → Updates and install everything: WordPress 7.1.3 and every plugin update, starting with The Events Calendar, Forminator, GiveWP and LatePoint.
2. On Avada sites, update the theme and its plugins to 7.16.2 through Avada’s own updater.
3. On WooCommerce stores, open Users → Shop manager and make sure you know everyone listed. On Dokan marketplaces, look through vendors registered in the last few weeks.
4. If a site runs a premium theme, check its author and changelog against this week’s batch of theme records.
5. Not sure what runs on a site you look after? Our free security review checks it from the outside and matches the plugin versions it can see against the same database. It only sees what the public pages reveal, so the plugin list in wp-admin remains the reference.

Where Must-Have Security fits

Updates close the holes on this list, and next week brings a new one. Several of this week’s worst bugs are a first step: privilege escalation in Forminator and GiveWP, object injection in The Events Calendar and in 49 premium themes, a file upload in Bricksforge. What the attacker does next is make it stick, with a backdoor file, an uploaded plugin or an edited theme file. All of those mean writing executable code to the server.

Must-Have Security puts a separate confirmation in front of exactly that step. On a protected site, being an administrator isn’t enough to write PHP files: it takes a passkey or authenticator code, and that factor isn’t stored in the database. So a hijacked admin session or a leaked database doesn’t let anyone plant a backdoor on its own. It makes it much harder for an attacker to run their own code; it doesn’t replace updates. For the SQL injection side, like this week’s LatePoint bug, we wrote up how the firewall catches injections without a signature.

How this report is made

We take every CVE record for WordPress core, plugins and themes published in the CVE List between Monday and Sunday (UTC), as collected in our database. Install counts are from WordPress.org on the Monday the report comes out. Fixed versions come from the advisory, the plugin’s changelog or the code change itself. The screenshots were taken on a local test site running the affected versions. The ratings are ours.

The next report covers October 12 to 18 and comes out on Monday, October 19.