WordPress vulnerabilities & exploitation

Exploitation timeline

Threadlinqs has recorded 5 WordPress CVEs published between 2026-07-15 and 2026-09-15. The busiest month was 2026-07 (2 new CVEs). 1 of them (20%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.

Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 5 of 5 tracked WordPress CVEs.

• CVE-2026-63030critical 9.8KEVEPSS 38.6%2026-07-17
• CVE-2026-65640high 8.8EPSS 1.9%2026-08-17
• CVE-2026-64638high 8.92026-08-07
• CVE-2026-87902high 8.12026-09-22
• CVE-2026-60137medium 5.92026-07-17

Products affected

Threadlinqs normalises CPE and CNA product records across all 5 CVEs; 1 distinct WordPress product is affected. The most frequently affected:

• WordPress 5 CVEs

Threat activity

46 tracked threat campaigns reference WordPress products or exploit WordPress CVEs; the 25 most recent are listed.

• Active Exploitation of WordPress Core Unauthenticated Upgrade-Window RCE (Versions 4.7 through 7.1.3) Hours After 7.1.4 Patch ReleaseCRITICAL2026-10-30
• WordPress 7.1.4 Security Release Patches 22 Vulnerabilities Including Core-Update Race Condition RCE and Multiple Stored XSSHIGH2026-10-29
• WordPress 7.1.4 Fixes 22 Security Flaws, Including an Unauthenticated RCE (Core Update Race Condition)HIGH2026-10-29
• EtherHiding Campaign Evolves: Blockchain-Hosted Payloads on 5,400+ Compromised Sites Add Covert WebRTC Data Channel C2HIGH2026-10-27
• TRUST#GRAFT: Logged-In WordPress Admin Sessions Abused to Silently Install PHP Backdoor via Fake 'Web Media Optimizer' PluginHIGH2026-10-27
• BUGSTER: Low-Skill Financially Motivated Actor Uses AI Agents (Hermes Agent/DeepSeek V4, Cursor IDE) to Plan and Execute Multiple Cybercrime OperationsMEDIUM2026-10-22
• ClearFake Uses Smart Contracts on BNB Smart Chain Testnet for C&C (EtherHiding) to Deliver SectopRAT and ACRStealerHIGH2026-10-19
• QuoIntelligence Weekly Snapshot W34 2026: AmnesiaStealer (macOS), ErrTraffic MaaS, Malicious RubyGems Packages (StubMaker), Ransom BustersMEDIUM2026-10-15
• September 2026 CVE Landscape: 94 high-impact vulnerabilities, NetScaler zero-days CVE-2026-88771/CVE-2026-88772, AI-agent-assisted exploitationCRITICAL2026-10-14
• Critical Ghostscript Heap Buffer Overflow in JPEG 2000 Output Adapter Enables RCE via Malicious PDFs (CVE-2026-39919)CRITICAL2026-10-13
• WordPress 7.1.3 Security Release: Seven Fixes Including Stored XSS, Second-Order SQL Injection and Unauthenticated Comment DisclosureMEDIUM2026-10-10
• CyberXero: AI-Augmented Initial Access Broker Targeting Ukrainian Critical Infrastructure and Global WordPress/E-commerce PlatformsHIGH2026-10-07
• Malicious HEIC Images Can Trigger Remote Code Execution on WordPress Servers via ImageMagick/libheif (GHSA-x8r2-mggj-j6wr)CRITICAL2026-10-05
• TIKTOUK Toolkit Harvests AWS, SMTP and Database Credentials from Exposed WordPress Backups and Config Files (CVE-2026-60137, CVE-2026-63030)HIGH2026-10-04
• Milk Dragon (NaiLong) Phishing-as-a-Service Kit Uses Facebook and TikTok Discounts to Steal Cards and Bypass MFAHIGH2026-10-04
• CVE-2026-87902: Critical Unauthenticated Local File Inclusion in WordPress Core (Conditional RCE)CRITICAL2026-09-22
• Chinese-Speaking 'Kapibala' Actor (Red Heron-Linked) Chains WordPress wp2shell, Zyxel GS1900, and Ubiquiti UniFi OS Flaws to Steal Government DataCRITICAL2026-09-22
• Click2Shell: WordPress Theme-Preview CSRF/Selector-Injection Chain to Forced Theme InstallCRITICAL2026-09-21
• ClearFake Drive-By Cluster Fuels CastleLoader Paste-and-Run Delivery of NetSupport RAT, CastleRAT, and a .NET StealerHIGH2026-09-20
• Click2Shell WordPress Exploit Chain Lets Attackers Gain RCE With a Single Malicious LinkCRITICAL2026-09-19
• Malware on the Blockchain: EtherHiding/Amatera ClickFix Campaign Adds a Covert WebRTC C2 ChannelHIGH2026-09-03
• ClickFix Cluster Uses DLL Sideloading and Compromised WordPress Sites to Deliver Lorem Ipsum Loader, Linked to Vanilla TempestHIGH2026-08-29
• Hundreds of WordPress Sites Hijacked via Malicious Plugins to Deploy Amatera Stealer through EtherHiding and ClickFixHIGH2026-08-29
• AI-Agent-Driven Offensive Operation: Mass Cryptocurrency Wallet and Credential Compromise via Autonomous AI Coding AgentsCRITICAL2026-08-19
• StopAndProtect: Compromised WordPress Sites Used as Malware Distribution Infrastructure for Ransomware, Stealer, and Worm PayloadsHIGH2026-08-18

Threat actors targeting WordPress

Named threat actors attributed to campaigns that involve WordPress products or CVEs, with the number of linked campaigns:

• KongTuke 3
• APT38 2
• GrayBravo 2
• MuddyWater 2
• Andariel 1
• APT28 1
• APT43 1
• DarkSpectre 1
• DriveSurge 1
• Kapibala 1
• Kimsuky 1
• Lazarus Group 1

How to prioritise WordPress patching

This order follows the data Threadlinqs holds for WordPress, not a generic severity checklist:

• 1 of 5 WordPress CVEs (20%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2026-63030.
• Outside KEV, the highest EPSS scores are CVE-2026-65640 (1.9%).
• 1 CVE scores Critical and 3 High on CVSS v3 (maximum 9.8, average 8.3); sequence these after KEV and high-EPSS items.
• 4 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-11-07 and refresh daily.