100 WordPress Security Alerts

WordPress site owners need to know what an attack can look like before a warning turns into an incident. This index links to 100 security guides, beginning with documented core vulnerabilities and continuing through exploit patterns to check in plugins, themes, integrations, and hosting.

100 WordPress security alerts

1. Core facilitated SQL injection (CVE-2026-60137)
2. REST batch-route confusion leading to code execution (CVE-2026-63030)
3. Page-template local file inclusion (CVE-2026-87902)
4. Unauthenticated REST endpoint access
5. REST API object authorization bypass
6. REST API privilege escalation
7. REST API mass assignment
8. Exposed custom REST routes
9. Unprotected admin-ajax.php actions
10. Unprotected admin-post.php actions
11. Administrator credential stuffing
12. Password spraying against WordPress logins
13. XML-RPC login abuse
14. Weak password-reset tokens
15. Password-reset link disclosure
16. Account enumeration through login responses
17. Two-factor authentication bypass in plugins
18. Session fixation
19. Stolen administrator session cookies
20. Application-password exposure
21. Subscriber-to-administrator privilege escalation
22. Contributor-to-editor privilege escalation
23. Unauthorized user creation
24. Unauthorized role changes
25. Insecure direct object references in plugins
26. Private post access bypass
27. Draft content disclosure
28. Unauthorized settings changes
29. Unauthorized plugin activation
30. Unauthorized theme installation
31. Stored cross-site scripting in comments
32. Stored cross-site scripting in profiles
33. Stored cross-site scripting in shortcodes
34. Stored cross-site scripting in block attributes
35. Reflected cross-site scripting in search
36. DOM-based cross-site scripting in page builders
37. Cross-site request forgery against settings
38. Cross-site request forgery against user management
39. Malicious redirects through open-redirect flaws
40. Clickjacking of administrative actions
41. SQL injection in search filters
42. SQL injection in sorting parameters
43. SQL injection in reporting dashboards
44. SQL injection in booking plugins
45. SQL injection in form plugins
46. Command injection in backup tools
47. Server-side template injection
48. PHP object injection through unsafe deserialization
49. Email-header injection in contact forms
50. Spreadsheet formula injection in exported CSV files
51. Unauthenticated arbitrary file upload
52. Executable files disguised as images
53. Archive extraction path traversal
54. Local file inclusion in themes
55. Remote file inclusion in plugins
56. Arbitrary file read through download endpoints
57. Arbitrary file deletion
58. Writable theme or plugin editor abuse
59. Publicly accessible database backups
60. Exposed migration archives
61. Checkout-field upload vulnerabilities
62. Order record access bypass
63. Customer data disclosure
64. Coupon creation without authorization
65. Unauthorized price changes
66. Cart total manipulation
67. Payment status spoofing
68. Webhook signature validation failures
69. Subscription ownership bypass
70. Gift-card balance manipulation
71. Contact-form attachment disclosure
72. Form submission data leakage
73. Booking token disclosure
74. Booking deletion without authorization
75. Membership access bypass
76. Paid-download authorization bypass
77. LMS course access bypass
78. Event-registration data exposure
79. Unauthorized post publication
80. Media-library access bypass
81. Server-side request forgery in URL preview tools
82. Server-side request forgery in import tools
83. Webhook endpoint authorization bypass
84. OAuth account-linking flaws
85. Exposed API keys in plugin settings
86. Backup restoration without authorization
87. Staging-to-production credential reuse
88. Vulnerable abandoned plugins
89. Compromised third-party plugin updates
90. Malicious nulled themes or plugins
91. Exposed wp-config.php backups
92. Public .git directories
93. Public debug logs containing secrets
94. Database administration panels left exposed
95. PHP execution inside upload directories
96. Insecure file permissions
97. Outdated PHP runtime vulnerabilities
98. Cross-site contamination on shared hosting
99. Cache poisoning that exposes private pages
100. Multisite tenant isolation bypass

The first three entries describe documented core vulnerabilities; the remaining entries describe classes of risk, not proof that every site is affected. Follow each guide's documentation and verify your installed versions before deciding what action is needed.