This website uses cookies, pixels, and similar technologies (collectively “Cookies”) to improve your browsing experience. By clicking “Accept All”, you agree to the storing of Cookies on your device and that we may share, track, store, and analyze your interactions with the website to enhance site navigation, analyze site usage, and assist in our marketing efforts. For more information on our use of cookies please review our Cookie Policy.
Top WordPress Security News for October 2025: presented by the Wordfence Threat Intelligence team.
Every week, the Wordfence team publishes unique threat intelligence data, research, alerts and threat analysis to the public WordPress community as part of our commitment to a Defense In Depth approach to security.
📭 Get the Latest WordPress Security Alerts and Product Updates
Sent to Your Inbox Weekly
Join The WordPress Security Mailing List
Follow Wordfence On Your Favorite Social Media Platform
These stories and more can be found on the Wordfence Blog.
-
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 20, 2025 to October 26, 2025)
Last week, there were 120 vulnerabilities disclosed in 111 WordPress Plugins and 4 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 53 Vulnerability…
-
Attackers Actively Exploiting Critical Vulnerability in WP Freeio Plugin
On September 25th, 2025, we received a submission for a Privilege Escalation vulnerability in WP Freeio, a WordPress plugin bundled in the Freeio premium theme with more than 1,700 sales.…
-
Rogue WordPress Plugin Conceals Multi-Tiered Credit Card Skimmers in Fake PNG Files
The Wordfence Threat Intelligence Team recently discovered a sophisticated malware campaign targeting WordPress e-commerce sites, specifically those using the WooCommerce plugin. This malware exhibits advanced features including custom encryption methods,…
-
100,000 WordPress Sites Affected by Arbitrary File Read Vulnerability in Anti-Malware Security and Brute-Force Firewall WordPress Plugin
On October 3rd, 2025, we received a submission for an Arbitrary File Read vulnerability in Anti-Malware Security and Brute-Force Firewall, a WordPress plugin with more than 100,000 active installations.
-
Mass Exploit Campaign Targeting Arbitrary Plugin Installation Vulnerabilities
On September 25th, 2024, and on October 3rd, 2024, we received submissions through our Bug Bounty Program for Arbitrary Plugin Installation vulnerabilities in the GutenKit and Hunk Companion WordPress plugins,…
-
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 13, 2025 to October 19, 2025)
Last week, there were 189 vulnerabilities disclosed in 147 WordPress Plugins and 22 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 55 Vulnerability Researchers that contributed to WordPress Security…
-
Malware Using Variable Functions and Cookies For Obfuscation
While some malware stands out by making an effort to blend in, obfuscation is generally the go-to way in which attackers attempt to evade detection and hide their scripts. In…
-
Wordfence Bug Bounty Program Monthly Report – September 2025
Last month in September 2025, the Wordfence Bug Bounty Program received 374 vulnerability submissions from our growing community of security researchers working to improve the overall security posture of the…
-
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 6, 2025 to October 12, 2025)
Last week, there were 55 vulnerabilities disclosed in 48 WordPress Plugins and 3 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 34 Vulnerability…
-
Quarterly WordPress Threat Intelligence Report – Q3 2025
As the leader in WordPress security, Wordfence provides unparalleled security coverage that fully encompasses protection, active monitoring, detection, and response all built around our threat intelligence, demonstrating a strong commitment…
-
4,000,000 WordPress Sites Affected by Arbitrary File Read Vulnerability in Slider Revolution WordPress Plugin
On August 11th, 2025, we received a submission for an Arbitrary File Read vulnerability in Slider Revolution, a WordPress plugin that’s estimated to have more than 4,000,000 active installations. This…
-
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 29, 2025 to October 5, 2025)
Last week, there were 136 vulnerabilities disclosed in 121 WordPress Plugins and 4 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 44 Vulnerability Researchers that contributed to WordPress Security…
-
Attackers Actively Exploiting Critical Vulnerability in Service Finder Bookings Plugin
On June 8th, 2025, we received a submission through our Bug Bounty Program for an Authentication Bypass vulnerability in Service Finder Bookings, a WordPress plugin bundled with the Service Finder…
-
Wordfence Intelligence Weekly WordPress Vulnerability Report (September 22, 2025 to September 28, 2025)
Last week, there were 475 vulnerabilities disclosed in 421 WordPress Plugins and 19 WordPress Themes that have been added to the Wordfence Intelligence Vulnerability Database, and there were 74 Vulnerability Researchers that contributed to WordPress Security…