Weekly WordPress report: 268 plugin and theme flaws disclosed
Original title：Wordfence Intelligence Weekly WordPress Vulnerability Report (October 19, 2026 to October 25, 2026)
What happened
Wordfence's weekly report lists 268 vulnerabilities across 182 plugins and 15 themes. 225 are patched, 43 are unpatched, and 7 are rated Critical.
Who is affected
- Anyone running a WordPress site
- Agencies managing many WordPress sites
What to do
Check whether your plugins or themes appear in the report and apply any updates. If you use UpdraftPlus, update to the latest version.
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| UpdraftPlus | 1.26.11以下(UDRPCキー漏えい) | 要確認 |
| その他多数のプラグイン・テーマ(Elementor、LiteSpeed Cache、Duplicator、Fluent Forms等を含む) | 要確認 | 要確認 |
Why this flag
悪用の確認はなく、個別サイトごとに該当プラグインの更新確認が必要な週次まとめのため。UpdraftPlusにはファイアウォールルールが追加されたが、悪用確認の記載はない。
Yellow flag: caution, slow down — Conditional updates, investigation or recovery follow-ups, and regulatory deadlines.
Sources
- Source：Wordfence Blog ↗