[REVISION HISTORY]

Cybersecurity vulnerabilities in WordPress and Joomla

Updated 8 times since CLSTR started tracking revisions of this situation.

What changed

2026-10-07 11:26 UTC → 2026-10-10 12:48 UTC · added ~~removed~~

Cybersecurity experts and agencies, including CISA, have reported an increase in attacks targeting WordPress and Joomla websites. Vulnerabilities in the WordPress ecosystem have risen significantly, with data from Patchstack indicating approximately 11,334 new vulnerabilities discovered in 2025, a 42 percent increase from the prior year. Most of these flaws reside in plugins and themes rather than the core software. Specific threats have been identified in the Astroid template framework and the JCE content editor, with risk scores reaching 10.0. A high-severity second-order SQL injection vulnerability, CVE-2026-19949, was identified in the All-in-One WP Migration and Backup plugin. While a patch was released in version 7.110, as of early September 2026, it was estimated that approximately 3.25 million installations were still running vulnerable versions. Additionally, a critical-severity vulnerability (CVE-2026-32475) in the Elementor Pro plugin allowed unauthenticated attackers to execute code via arbitrary file uploads. Although patched in version 4.2.2 on August 19, threat actors began exploiting the defect immediately. In mid-September 2026, a supply chain attack involving the Admin Menu Editor Pro plugin compromised approximately 1,500 websites. Following the release of WordPress 7.1.2 on September 22, a critical unauthenticated path traversal vulnerability (CVE-2026-87902) was discovered in WordPress Core. By October 2026, researchers identified a campaign exploiting stored cross-site scripting (XSS) vulnerabilities in the Ninja Forms (CVE-2026-94504) and WPC Product Bundles for WooCommerce (CVE-2026-93836) plugins. Attackers plant malicious JavaScript within form submissions or order data to hijack administrator sessions, allowing them to install backdoors, create rogue administrator accounts, and use backdated file timestamps to evade detection. Experts warn that simply updating these plugins may not be sufficient, as attackers may have already established persistence through hidden administrator accounts that do not appear in standard user lists.

Versions

Only revisions since CLSTR began indexing content versions appear here. Select a version to see what changed compared to the one before it.