Advisories

WordPress vulnerabilities worth acting on

WordPress vulnerabilities that are being exploited in the wild or affect a large number of sites, with what each one does and how to fix it.

Last verified Oct 7, 2026

Current advisories

Known exploitedCVSS 10.0 (CVE record)CVE-2020-25213
CVE-2020-25213 in File Manager
WP File Manager 6.8 and earlier lets unauthenticated attackers upload and run PHP files. It has been exploited in the wild; update to 6.9 or later now.
Component
File Manager
Patch status
Fixed in 6.9
Installs still vulnerable
0% of installs not yet updated
Known exploitedCVSS 7.5 (CVE record)CVE-2020-11738
CVE-2020-11738 in Duplicator Pro
Duplicator before 1.3.28 and Duplicator Pro before 3.8.7.1 let unauthenticated attackers read any file on the server. It is being exploited; update now.
Component
Duplicator Pro
Patch status
Fixed in 3.8.7.1
Known exploitedCVSS 9.8 (CVE record)CVE-2026-63030
CVE-2026-63030 in WordPress
WordPress 6.9.0 to 6.9.4 and 7.0.0 to 7.0.1 have a remote code execution flaw in the REST API batch route that is being exploited. Update to 6.9.5 or 7.0.2.
Component
WordPress
Patch status
Fixed in 6.9.5
CVSS 9.8 (CVE record)CVE-2026-82901
CVE-2026-82901 in Ultra Addons for Contact Form 7
Ultra Addons for Contact Form 7 up to 3.5.50 lets unauthenticated visitors upload arbitrary files via a signature field. Update to 3.5.51 or later.
Component
Ultra Addons for Contact Form 7
Patch status
Fixed in 3.5.51
CVSS 9.8 (Wordfence)CVE-2026-84750
CVE-2026-84750 in Ultra Addons for Contact Form 7
Ultimate Addons for Contact Form 7 3.2.4 to 3.5.50 lets unauthenticated visitors upload arbitrary files through a form field. Update to 3.5.51 or later.
Component
Ultra Addons for Contact Form 7
Patch status
Fixed in 3.5.51
CVSS 6.5 (CVE record)CVE-2026-19859
CVE-2026-19859 in JetFormBuilder — Dynamic Blocks Form Build
JetFormBuilder before 3.6.5.2 lets unauthenticated visitors run arbitrary shortcodes through its 'status' parameter. Update to version 3.6.5.2 or later.
Component
JetFormBuilder — Dynamic Blocks Form Builder
Patch status
Fixed in 3.6.5.2
Installs still vulnerable
at least 28.64% of installs not yet updated

Subscribe by RSS

Hacked? Talk to us