WordPress core and plugins hit by remote code execution flaws; check updates
Original title：Wordfence Intelligence Weekly WordPress Vulnerability Report (October 26, 2026 to November 1, 2026)
What happened
Wordfence's weekly report lists unauthenticated remote code execution flaws in WordPress core, The Grid and YOOtheme Pro, with firewall rules deployed. In total 549 vulnerabilities were disclosed, 41 of them still unpatched.
Who is affected
- Anyone running a WordPress site
- Users of The Grid or YOOtheme Pro
- Sites with many plugins installed
What to do
Update WordPress core, plugins and themes to the latest versions, and check for fixed releases of The Grid and YOOtheme Pro. Remove unused plugins.
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| WordPress Core | 4.7.0 – 7.1.3(記載のまま、要確認) | 要確認 |
| The Grid | 2.8.1 以下 | 要確認 |
| YOOtheme Pro | 5.0.0 – 5.0.52 | 要確認 |
Why this flag
認証不要のリモートコード実行などの重大な欠陥が複数あり防御ルールも配備されたが、実際の悪用は明記されていないため。修正版は要確認。
Double yellow: great danger, be ready to stop — Severe impact with a public exploit or reported (unconfirmed) exploitation, including RED candidates under review.
Sources
- Source：Wordfence Blog ↗