Wordfence Weekly Vulnerability Report: 78 Vulnerabilities Disclosed, 12 Unpatched, AI Engine 3.4.9 Mitigated
Run the Wordfence CLI Vulnerability Scanner to detect unpatched vulnerabilities and apply the latest patches.
Run the Wordfence CLI Vulnerability Scanner on all sites, patch the 12 unpatched vulnerabilities, and enable the new firewall rules for AI Engine 3.4.9.
Summary
Wordfence Intelligence released a weekly report detailing 78 vulnerabilities across 62 WordPress plugins and 2 themes, with 59 researchers contributing. The report highlights that 66 vulnerabilities were patched while 12 remain unpatched, with severity distribution of 54 medium, 21 high, and 3 critical. A new firewall rule was deployed to protect against an authenticated privilege escalation in AI Engine 3.4.9 via missing authorization in MCP OAuth Bearer Token. Wordfence’s free API, webhook, and CLI tools allow customers to consume the vulnerability database and receive real‑time updates. The report also lists the top vulnerability types by CWE, including XSS, missing authorization, and SQL injection.
The data underscores the importance of regular vulnerability scanning and timely patching, especially for high‑severity issues. Wordfence’s free tools enable site owners to stay ahead of new threats and maintain a robust security posture.
Key changes
- 78 vulnerabilities disclosed in 62 plugins and 2 themes
- 66 patched, 12 unpatched vulnerabilities
- 54 medium, 21 high, 3 critical severity distribution
- New firewall rule protects against AI Engine 3.4.9 privilege escalation
- Wordfence API, webhook, and CLI are free to use
- 59 vulnerability researchers contributed