Wordfence: 655 WordPress vulnerabilities in one week, themes under attack

The Wordfence Intelligence database received 655 vulnerabilities in the week of 5–11 October 2026, distributed across 406 plugins and 100 WordPress themes. The reports were contributed by 236 security researchers. For those managing WordPress hosting or multiple installations on behalf of clients, the figure to watch is not just the total but its composition: the number of affected themes is what marks the difference compared to previous weeks.

Comparison with previous weeks

Looking at the latest weekly reports published on the Wordfence blog, the increase is marked, particularly for themes:

Week	Vulnerabilities	Plugins	Themes	Researchers
14–20 September 2026	362	247	4	186
28 September – 4 October 2026	501	367	9	201
5–11 October 2026	655	406	100	236

In a month, the number of weekly vulnerabilities has nearly doubled (from 362 to 655) and the affected themes have risen from 4 to 100. For those administering sites with commercial or custom themes, this is another reason to include themes, not just plugins, in your regular update checks.

Quarterly context

The weekly figure should be read alongside what Wordfence reported in the Quarterly WordPress Threat Intelligence Report for Q2 2026, where they cited a total of 2,073 published vulnerabilities, with high-threat vulnerabilities rising to 182, up 15.2% from the previous quarter. The underlying trend, in short, is not new: the number of weekly reports has been growing steadily for months.

What to do in practice

The Wordfence Intelligence database remains freely accessible via web interface, API and CLI scanner, free for both personal and commercial use. For those managing multiple installations, integrating the API into your automated patching controls remains the fastest way to catch new entries each week before they are actively exploited, as has already happened in the past with widely-deployed plugins.