Wordfence: 2,073 WordPress vulnerabilities, 573,000 infected sites in Q2 2026

Wordfence published its quarterly threat intelligence report on the WordPress ecosystem on 29 September 2026, covering the second quarter of 2026. For anyone managing shared hosting or VPS with clients' WordPress installations, the figures show just how much hostile traffic hits plugins and themes every day, well before a site is actually breached.

The quarter's figures

According to Wordfence's official report, 2,073 WordPress vulnerabilities were disclosed in Q2 2026, of which 182 were classified as "high threat". Over the same period, Wordfence's Web Application Firewall blocked 10.4 billion attacks and 18.2 billion brute-force attempts. The report also flags 573,000 infected sites detected during the quarter.

Metric	Q2 2026 value
Vulnerabilities disclosed	2,073
High-severity vulnerabilities	182
WAF attacks blocked	10.4 billion
Brute-force attempts blocked	18.2 billion
Infected sites detected	573,000

Wordfence states it also analysed the most common vulnerability classes, attacker activity and malware trends found on compromised sites, although the press release does not break these subcategories down numerically.

What this means for hosting providers

For a provider or agency hosting third-party WordPress installations, the most operationally relevant figure is the high-severity vulnerability count: 182 in three months works out to more than two per week on average, concentrated in plugins and themes that need to be monitored with an up-to-date scanning system, not just the WordPress core. The volumes of blocked attacks (WAF and brute-force) confirm that hostile traffic against login endpoints and REST endpoints is now a constant background noise, and needs to be filtered upstream rather than dealt with case-by-case after an incident.

The full report, including the breakdown of vulnerability classes and malware trends, is available on Wordfence's official blog at the address given in the source.