WordPress Security in Short
WordPress core is well looked after. The security team ships fixes quickly, and since version 3.7 sites install minor security releases on their own unless that has been turned off. Most hacked WordPress sites were broken into through a plugin or theme, not core, so pick yours when you sign up for alerts.
How to Keep WordPress Patched
- Leave automatic minor updates on. Check Dashboard › Updates after each security release to make sure it went through.
- Turn on automatic updates for plugins you trust, and remove plugins you no longer use: a deactivated plugin's files can still be attacked.
- Keep PHP itself up to date. WordPress runs on it, and a PHP flaw such as PHP2Shell affects every WordPress site on that server.
- If your host manages WordPress for you, check what they patch and how quickly.
2 flaws scored 8+, newest first.
WordPress flaws CISA has added to its list of flaws attackers are using in the past six months, newest first. See all 5 on the KEV page.
Patch nowWordPress
WordPress Core is vulnerable to Remote Code Execution in versions 4.7 through 7.1.3.
Score 8.1 / 10 · Being exploited · Fixed in 4.7.39, 4.8.34, 4.9.35, 5.0.31
CVE-2026-119977
On HN
Patch nowWordPress
An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php`…
Score 8.1 / 10 · Being exploited · Fixed in 4.7.37, 4.8.32, 4.9.33, 5.0.29
CVE-2026-87902
Patch nowWordPress
WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which,…
Score 9.8 / 10 · Being exploited · Fixed in 6.9.5, 7.0.2
CVE-2026-63030
On HN
Patch nowWordPress
WordPress 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 does not properly sanitise the author__not_in par…
Score 5.9 / 10 · Being exploited · Fixed in 6.8.6, 6.9.5, 7.0.2
CVE-2026-60137