Wordfence launches new channel for reporting active WordPress threats

Wordfence announced on 26 October 2026 the launch of the Threat Response Team, a new channel for reporting active threats in the WordPress ecosystem. For those managing dozens or hundreds of WordPress installations on shared hosting or VPS, it's an additional point of contact to keep at hand when you spot an attack and need to escalate it quickly.

What's changing

Wordfence describes the new team as small and technically operational, tasked with turning emerging threats into protection for customers and clear guidance. Anyone who identifies an active threat can write directly to threat-response@wordfence.com.

Wordfence's announcement does not specify guaranteed response times or whether the service is reserved for paying customers or open to anyone reporting an issue in the ecosystem.

How it fits with Wordfence's other channels

Wordfence has long had other addresses for different types of reports. On the official Vulnerability Disclosure Policy page, the company explains that to request CVE assignment for WordPress plugins, themes or core, you should email cve-request@wordfence.com, whilst to report a vulnerability in Wordfence's own products or services the address is security@wordfence.com. The company clarifies that the latter is strictly reserved for security vulnerabilities: technical support requests are discarded and should be directed to the support portal.

The new threat-response@wordfence.com occupies a different space: it's not for obtaining a CVE or reporting bugs in Wordfence products, but for bringing to the team's attention an attack or ongoing campaign against WordPress sites, regardless of the licence you hold.

What to do in practice

If you manage WordPress hosting and notice an unusual attack pattern — spikes in suspicious requests, exploits on undocumented plugins, ongoing compromise campaigns — you now have a specific contact for reporting it, distinct from customer support channels and CVE request channels.