Wordfence Reports 87 New WordPress Vulnerabilities in April 2026

Wordfence Intelligence, the security arm of the popular WordPress plugin, released its April 2026 vulnerability report on Monday, detailing 87 newly disclosed security flaws across 198 plugins and five themes. Of the 87 issues, 84 have already been patched by their developers, leaving only three vulnerabilities unaddressed. The report categorises the flaws by severity: 50 are medium, 34 high, and three critical, underscoring the ongoing risk to the WordPress ecosystem.

The most common weaknesses involve cross‑site scripting (30 instances), missing authorisation controls (19 cases), and SQL injection vulnerabilities (10 cases). Wordfence credits 60 independent researchers for the discoveries, naming contributors such as daroo, Luc Huynh, and Naoya Takahashi. In response to the findings, the company rolled out new firewall rules—WAF‑RULE‑909 and WAF‑RULE‑910—available to premium customers, designed to block exploitation attempts before they reach the application layer.

Wordfence’s free tools, including a vulnerability database, API, webhook integration, and a command‑line scanner, allow site owners to run regular checks and receive real‑time alerts. While free users receive immediate protection for patched vulnerabilities, they are warned that unpatched issues will only be protected after a 30‑day delay, highlighting the importance of timely updates. The report stresses that layered security—combining plugin hardening, timely patching, and firewall rules—is essential for defending WordPress sites against evolving threats.

For site administrators, the takeaway is clear: review the list of affected plugins and themes, apply any available patches immediately, and consider upgrading to premium security features if they manage high‑traffic or sensitive sites. Wordfence’s transparent reporting and proactive rule deployment aim to help the WordPress community stay ahead of attackers while reinforcing the need for continuous vigilance in web security.