WordPress plugin vulnerabilities in 2026: the worst ones
Patchstack counted 11,334 new WordPress vulnerabilities in 2025, 91% of them in plugins, and found the median time from disclosure to first exploit was five hours. Here are the critical plugin flaws of 2026 so far — the ones scored 9.8 and the ones attackers have already used — with the versions to update to.
The numbers
- 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up 42% on the year before.
- 91% were in plugins, 9% in themes. WordPress core had six, all low priority.
- 1,966 were high severity — more than double the previous year.
- 46% had no fix available when they were disclosed.
- Weighted median time to first exploitation: five hours.
- Premium plugins and themes had three times more known exploited vulnerabilities than free ones. Broken access control was the most exploited class.
Source: Patchstack, “State of WordPress Security in 2026” (covering 2025 data). The five-hour figure is the one to remember: by the time a vulnerability is in the news, sites that update weekly have already been exposed.
Exploited in the wild in 2026
| Plugin | CVE | What it allows | Affected → fixed |
|---|---|---|---|
| Modular DS (40,000+ sites) | CVE-2026-23550 | Unauthenticated privilege escalation; attackers created rogue “backup” admin accounts from 13 January | 2.5.1 and older → 2.5.2; Patchstack advises 2.6.0+, which also fixes CVE-2026-23800 |
| Bricksforge (premium) | CVE-2026-85097 | Unauthenticated file upload leading to remote code execution; attacks seen from 7 October | 3.1.8.9 and older → 3.1.8.10 |
Both are confirmed exploited by Patchstack, which observed the attacks. No third-party plugin has been added to CISA’s Known Exploited Vulnerabilities catalog in 2025 or 2026 — only WordPress core flaws — so CISA’s list alone will not warn you about plugin attacks.
Other critical (CVSS 9.8) plugin flaws
| Plugin | CVE | What it allows | Affected versions |
|---|---|---|---|
| Kirki (500,000+ sites) | CVE-2026-8206 | Unauthenticated account takeover through password reset | 6.0.0 – 6.0.6 |
| Breeze Cache (300,000+) | CVE-2026-3844 | Unauthenticated file upload, only when “Host Files Locally – Gravatars” is enabled | 2.4.4 and older |
| Burst Statistics (200,000+) | CVE-2026-8181 | Authentication bypass leading to admin takeover | 3.4.0 – 3.4.1.1 |
| Pods (100,000+) | CVE-2026-19598 | Authorization bypass leading to privilege escalation | 3.3.9 and older → 3.3.9.1 |
| Everest Forms Pro (premium) | CVE-2026-3300 | PHP code injection through eval(), leading to remote code execution | 1.9.12 and older |
| WP Maps Pro (premium) | CVE-2026-8732 | Unauthenticated creation of admin accounts | 6.1.0 and older |
Scores and affected versions are from the National Vulnerability Database; install counts from WordPress.org on 30 October 2026. Where no fixed version is shown, update to the newest release and read its changelog — and if a premium plugin has had no release since its CVE was published, treat it as unpatched.
What to do
- Turn on auto-updates for plugins (Plugins → Enable auto-updates). Five hours is shorter than any manual update routine.
- Premium plugins do not auto-update unless the licence is active. Check that every paid plugin can still reach its update server.
- Remove plugins you are not using — deactivated plugins can still be attacked if their files are reachable.
- Every few weeks, list your administrator accounts and compare against your team.
- Look up your plugins in the Patchstack or NVD databases when a critical flaw is announced, rather than waiting for a newsletter.