Wordfence Weekly Report Adds 199 WordPress Vulnerabilities

Wordfence published its latest weekly WordPress vulnerability report on July 2, covering disclosures added to the Wordfence Intelligence Vulnerability Database for June 22 through June 28, 2026. The report says 199 vulnerabilities were disclosed across 169 WordPress plugins and 9 themes, with 111 vulnerability researchers credited for the week.

The headline number is larger than the last Wordfence weekly report sxz.io covered in June, but the operational signal is not just volume. Wordfence marked 51 of the 199 entries as unpatched at publication time and listed six critical-severity issues. For agencies, hosts, and site owners that manage many WordPress installs, the report is a reminder that plugin and theme inventory is part of the security perimeter, not a background maintenance task.

What Wordfence counted this week

Wordfence’s report breaks the week into 148 patched vulnerabilities and 51 unpatched vulnerabilities. By severity, it lists 1 low-severity issue, 143 medium-severity issues, 49 high-severity issues, and 6 critical-severity issues. The most common weakness classes were cross-site scripting with 53 entries, missing authorization with 52 entries, SQL injection with 29 entries, CSRF with 15 entries, and sensitive information exposure with 9 entries.

Those numbers should be read as a triage queue rather than a prediction that every site is immediately exposed. A vulnerability only matters to a given site if the affected plugin or theme is installed, active, reachable, and in a vulnerable version range. But the mix of missing authorization, account takeover, SQL injection, and file-upload flaws shows why operators need a current component inventory before they can make useful risk decisions.

The critical entries are concentrated in privilege and upload risk

The six critical entries are the week’s most urgent part of the report. Wordfence marked Dokan Pro <= 5.0.4 as a patched unauthenticated privilege-escalation issue tracked as CVE-2026-56033. It also listed two separate unpatched Invoice Generator <= 1.0.0 issues: CVE-2026-12416 for unauthenticated account takeover through weak password reset validation and CVE-2026-12415 for unauthenticated privilege escalation through account takeover.

Wordfence also highlighted OMGF Pro <= 5.2.6, CVE-2026-57700, as a patched unauthenticated arbitrary-file-upload issue via @import URL reflection. The same report says Wordfence rolled out a real-time firewall rule for that issue to Premium, Care, and Response customers, while users of the free version receive enhanced protection after a 30-day delay. The remaining critical entries were Paytium <= 5.0.2, CVE-2026-56030, marked patched, and SignUp & SignIn <= 1.0.0, CVE-2026-12417, marked unpatched.

Why this is an inventory problem for WordPress operators

The official WordPress hardening guidance frames security as risk reduction rather than risk elimination. It specifically recommends keeping WordPress software up to date and using trusted sources for plugins and themes, such as WordPress.org or known companies. That maps directly to Wordfence’s weekly data: the first question is whether the affected components exist in the environment, and the second is whether an update or removal path is available.

For managed WordPress fleets, the most useful response is a short evidence trail. Teams should identify sites that run the affected slugs, record installed versions, separate patched from unpatched findings, and prioritize internet-facing sites that allow subscriber, contributor, customer, or unauthenticated interaction. Where an issue is marked unpatched, disabling the component or adding compensating controls may be safer than waiting for a release while the vulnerable code remains exposed.

Disclosure still needs care

The WordPress plugin team’s plugin security reporting guidance warns against public disclosure before a plugin issue is handled because wider awareness can increase compromise risk without necessarily speeding a fix. That is important context for weekly vulnerability roundups. Publishing counts helps defenders triage, but operators should avoid turning every report into noisy panic for site owners who may not run the affected components.

A better workflow is to pair the public report with private asset data: installed plugin and theme lists, active version numbers, backup status, update windows, and owner contacts. Once a vulnerable component is confirmed, the fix path should be specific to that component and site. If the plugin is not installed, the report should be closed as not applicable rather than left as an unresolved security warning.

Bottom line

Wordfence’s June 22–28 report is a fresh snapshot of the WordPress plugin and theme vulnerability stream. The 199-entry total is notable, but the sharper operational fact is that 51 entries were unpatched and six were critical. WordPress teams that already maintain reliable inventories, backups, and update gates can turn the report into a prioritized queue. Teams without that inventory have to start by finding what they run before they can know what they need to fix.

Sources: Wordfence Intelligence Weekly WordPress Vulnerability Report for June 22–28, 2026, WordPress hardening guidance, and WordPress plugin security reporting guidance.

Featured image: Cyber Security at the Ministry of Defence, photo by Harland Quarrington/MOD, licensed under the Open Government Licence v1.0; cropped, resized, and converted to WebP.