- Wordfence logged 549 vulnerabilities in 351 plugins and 4 themes in one week. It separately added firewall rules for five issues, including one in WordPress Core.
- The count measures a whole ecosystem of add-ons, not one product. Core can look quiet in one database while plugin flaws pile up in another.
- Ask who watches your plugins, how fast fixes reach production, and whether your firewall rules arrive at once or after a 30-day delay.
A WordPress site is a stack of other people's code
Owning a WordPress site means depending on every plugin author you install. Each plugin is software written by someone else, and each one can break. The weekly Wordfence report makes that dependency visible. It is a count of how many strangers had a bad week.
Wordfence says 549 vulnerabilities were added to its Intelligence database for the week of October 26 to November 1, 2026. They were disclosed in 351 plugins and 4 themes. Wordfence says 222 researchers contributed to WordPress security that week.
The lesson here is that plugin risk is not one number about one product. It is a rate at which small parts fail, and your exposure depends on how many parts you run and how quickly you replace the faulty ones.
What the firewall rules cover
Wordfence's threat team reviews each finding for impact and likelihood of exploitation. It then decides whether its firewall gives enough protection. A firewall rule here is a filter that blocks requests built to trigger a flaw, which can protect a site before its owner installs a fix.
The firewall rules are a separate list from the 549 count. The source does not say these issues are part of that count. In the week of October 26 to November 1, Wordfence added rules for five issues. Three are named in the report. WordPress Core versions 4.7.0 through 7.1.3 have an unauthenticated "upgrade-window staged-installer" remote code execution flaw. The Grid, in versions up to 2.8.1, has an unauthenticated remote code execution flaw. YOOtheme Pro 5.0.0 through 5.0.52 has an unauthenticated arbitrary file upload flaw.
The other two rules are listed only by number, WAF-RULE-968 and WAF-RULE-972. Wordfence says it redacted their data while it works with the vendor on a patch.
What the labels mean
"Unauthenticated" means an attacker needs no login. "Remote code execution" means an outsider can make the server run commands of their choosing. "Arbitrary file upload" means an outsider can place a file on the server, which can lead to the same outcome.
The report gives only the titles of these flaws. It does not describe how the core issue works, and it does not say any of them is being exploited. We will not guess at either. The core range, 4.7.0 to 7.1.3, is wide. It covers a very large span of releases, so check which version you run.
Two databases, two stories
WebPulse's own record for WordPress tells a different story. Its NIST NVD profile for WordPress, refreshed on November 8, lists 585 CVEs in total and 4 in the last 12 months. Five are in CISA's Known Exploited Vulnerabilities catalogue.
These figures do not conflict with Wordfence's. They measure different things. Wordfence says its database covers core, themes and plugins, and holds over 40,000 vulnerabilities. The NVD profile is likely to look quiet because most findings sit in plugins and themes, which are tracked elsewhere. The data does not say so directly.
Protection that arrives on a schedule
Wordfence says Premium, Care and Response customers received the new rules immediately. Users of the free version get them after a 30-day delay. The report says nothing about whether any of these flaws is exploited in that window, so the delay is a fact to weigh, not proof of harm.
This is a pricing decision, but it is also a risk decision. A company that relies on the free tier has chosen a 30-day lag on firewall protection. Someone should have made that choice on purpose.
What to ask your team
Ask for a current list of every plugin and theme on your WordPress sites, with version numbers. Without it, a report like this cannot be matched to your estate.
Ask who reads these reports and how soon a patch reaches production. Wordfence says its database is free to use, including an API and a webhook that sends new entries as they are added. A feed is useful only if a person owns it.
Ask which tier of firewall protection you run, and whether the 30-day delay for free users is acceptable for each site. Check the three named products against your inventory first.
A weekly count of 549 is not a verdict on WordPress. It shows how many separate parts can fail, and why every owner needs an inventory of theirs.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Wordfence.
