On October 28th, 2026, the WordPress Security Team released WordPress 7.1.4, along with backported security releases for older branches, addressing several security issues, most notably an Unauthenticated Remote Code Execution vulnerability in WordPress core, identified as CVE-2026-119977. The vulnerability affects… Continue Reading →
On October 22, 2026, Google published CVE-2026-111497, a critical vulnerability in Brotli, one day after the Brotli project released fixed versions. The vulnerability has circulated under several unofficial names, including HTTP2Shell, Node2Shell, and Brotli2Shell. Despite the first name, the flaw… Continue Reading →
TL;DR: WordPress 7.1.4 was released on October 28, 2026. According to WordPress, it includes fixes for 22 security vulnerabilities. The most serious is an unauthenticated race condition in the Core update process that can lead to remote code execution. Threat… Continue Reading →
In July 2026, the Wordfence Bug Bounty Program received 1077 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence… Continue Reading →
Last week, there were 268 vulnerabilities disclosed in 182 WordPress Plugins and 15 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 124 Vulnerability Researchers that contributed to WordPress Security last week. Review those… Continue Reading →
Last week, there were 497 vulnerabilities disclosed in 327 WordPress Plugins and 23 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 218 Vulnerability Researchers that contributed to WordPress Security last week. Review those… Continue Reading →
