Published file metadata, source observations, indicators, and research history in one bounded catalog.
10Reachable catalog records
1 / 1Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
src_7706c53fe6d3939218Collection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
10 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
Wordfence's Q2 2026 threat intelligence report covers 2,073 published WordPress vulnerabilities, 182 high threat vulnerabilities, 10.4 billion blocked WAF attacks, 18.2 billion blocked brute force attacks, and 573K infected sites, plus trends in vulnerability classes, attacker activity, and malware. The post Quarterly WordPress Threat Intelligence Report – Q2 2026 appeared first on Wordfence.
First reported Sep 29, 2026 18:15 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
WordPress has released security updates for a critical unauthenticated path traversal vulnerability that can lead to local PHP file inclusion and, on affected server and theme configurations, remote code execution. Site owners should update WordPress Core immediately. The post PSA: Critical Unauthenticated Path Traversal Vulnerability Patched in WordPress Core appeared first on Wordfence.
First reported Sep 22, 2026 22:21 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
In June 2026, the Wordfence Bug Bounty Program received 1066 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the WordPress ecosystem. These submissions are reviewed, triaged, and processed by the Wordfence Threat Intelligence team, with validated vulnerabilities responsibly disclosed to vendors, often through the Wordf
First reported Sep 25, 2026 16:52 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
Last week, there were disclosed in that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, ...Read More The post W
First reported Sep 17, 2026 17:47 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
Last week, there were disclosed in that have been added to the Wordfence Intelligence Vulnerability Database, and there were that contributed to WordPress Security last week. Review those vulnerabilities in this report now to ensure your site is not affected. Our mission with Wordfence Intelligence is to make valuable vulnerability information easily accessible to everyone, ...Read More The post W
First reported Oct 01, 2026 18:17 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
Wordfence Argus discovered a PHP Object Injection vulnerability in Tutor LMS, affecting more than 100,000 WordPress sites. Subscriber-level attackers could achieve remote code execution. Update to version 4.0.8 as soon as possible. The post 100,000 WordPress Sites Exposed to Remote Code Execution via PHP Object Injection Vulnerability Found by Wordfence Argus in Tutor LMS appeared first on Wordfen
First reported Sep 17, 2026 20:17 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
Wordfence 9 introduces passkeys, and passkeys provide a huge friction reduction because your user no longer has to remember their password or retrieve it from a password manager and copy/paste. The post Boost Engagement with Free Passkeys by Wordfence appeared first on Wordfence.
First reported Sep 15, 2026 19:55 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
Wordfence Argus found a critical CVSS 9.8 vulnerability in libheif, a library many servers use to process HEIC images. We demonstrated protected-file disclosure and code execution on one exact WordPress deployment. Exploitation is target-specific, but HEIF Heist shows that adapting image exploits to real systems is practical. The post Wordfence Argus Discovers Critical Vulnerability in libheif, th
First reported Sep 18, 2026 18:22 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
The Wordfence Threat Intelligence Team identified an interesting malware sample in mid June during a site clean. TThe malware was installed as a must-use plugin with several self-healing mechanisms in place in order to survive removal The post Inside a Malicious, Stealthy WordPress Must Use Plugin appeared first on Wordfence.
First reported Sep 22, 2026 14:56 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
Last week, there were 358 vulnerabilities disclosed in 243 WordPress Plugins and 4 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 184 Vulnerability Researchers that contributed to WordPress Security last week. The post Wordfence Intelligence Weekly WordPress Vulnerability Report (September 14, 2026 to September 20, 2026) appeared first on
First reported Sep 24, 2026 17:44 UTCCatalog metadata updated Oct 08, 2026 03:54 UTCOpen evidence record
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.