WordPress vulnerabilities, September 2026: the ones on sites people actually run

Thirty-five critical records in twenty-one days, every one of them a plugin. Most are on software nobody you know runs. These are the exceptions.

Every row below comes from the Wordfence Intelligence database, linked to its own record, with the patched version taken from that record rather than typed from memory. Install numbers are what WordPress.org reported on 22 September 2026, and paid plugins do not publish one, which is not the same as being small.

Start with core

WordPress published eleven security fixes on 17 September, including the forced theme install researchers chain into code execution and call Click2Shell, and an unauthenticated stored cross-site scripting flaw in the function that formats almost everything WordPress renders.

Every branch that still receives fixes got a backport, from 7.1.1 down to 4.7.36. Compare against your own branch, not the newest WordPress, and note that the two August releases do not cover this one. The full branch table and what to check afterwards are in the Click2Shell write-up.

Plugins from WordPress.org

Plugin	Active installs	Fixed in	Published	Record
The Events Calendar Unauthenticated PHP object injection to remote code execution.	600,000	6.17.4.1	11 September	CVE-2026-78006 · 9.8
The Events Calendar Unauthenticated code injection through a widget callable.	600,000	6.17.3.1	11 September	CVE-2026-78159 · 9.8
Forminator Forms Unauthenticated arbitrary shortcode execution through the 'current_url' parameter.	600,000	1.57.3	18 September	CVE-2026-92229 · 9.1
Amelia (booking) Unauthenticated privilege escalation to administrator through 'externalId'.	90,000	9.6.3	1 September	CVE-2026-9055 · 9.8
JetFormBuilder Unauthenticated arbitrary shortcode execution.	80,000	3.6.5.2	3 September	CVE-2026-19859 · 9.8
JetFormBuilder Unauthenticated privilege escalation through a booking form id.	80,000	3.6.2.1	15 September	CVE-2026-12793 · 9.8
Hummingbird Unauthenticated remote code execution through a cookie name written into the page cache debug log.	70,000	3.21.1	4 September	CVE-2026-83627 · 9.8
WP Recipe Maker Unauthenticated arbitrary shortcode execution through recipe comment content.	50,000	10.8.2	18 September	CVE-2026-89274 · 9.1
Post Grid and Gutenberg Blocks Unauthenticated hook injection.	30,000	2.3.23	4 September	CVE-2024-11080 · 9.8

The Events Calendar is the one worth acting on first if it is anywhere in your portfolio: two unauthenticated paths to code execution published the same day, on around 600,000 sites. Note the two patched versions are on different branches, so read the one that matches what you run.

Plugins you bought

These never appear in an install-count table, and they are the ones sitting on client sites with a licence key that expired quietly two years ago, which is the real reason a paid plugin goes unpatched.

Plugin	Fixed in	Published	Record
Gravity Forms Unauthenticated arbitrary file upload through a hidden file upload field.	3.1.1	18 September	CVE-2026-84434 · 9.8
Meta Box AIO and its standalone extensions Unauthenticated privilege escalation to administrator through a frontend field object id.	3.12.0	21 September	CVE-2026-13355 · 9.8
Drag and Drop File Upload for Elementor Forms Unauthenticated arbitrary file upload through the 'type' parameter.	1.6.1	9 September	CVE-2026-18351 · 9.8
MStore API Unauthenticated authentication bypass through JWT forgery.	4.21.1	4 September	CVE-2026-13447 · 9.8
Mail Mint Unauthenticated PHP object injection through arbitrary form fields.	1.31.1	4 September	CVE-2026-10196 · 9.8
MemberDash Unauthenticated account takeover through an 'id' parameter.	1.8.6	5 September	CVE-2026-16310 · 9.8

Gravity Forms is the headline here by reach. An expired licence still leaves the plugin running and stops the update from arriving, so "we use Gravity Forms" and "our Gravity Forms is current" are different sentences.

The one no version fixes

On 14 September an attacker reached the server distributing Admin Menu Editor Pro and published builds carrying a web shell. Versions 2.35 and 2.36 went out compromised, to roughly 230 customers across about 1,500 sites. The record lists no patched version, which is the correct answer: the malicious code already ran, and what it left behind is not plugin files.

The free Admin Menu Editor on WordPress.org was not affected. If you run the Pro plugin, the file and database indicators to check are worth ten minutes today.

What the month rhymes with

Read the two tables again and the same sentence keeps appearing: unauthenticated. No account, no password, no social engineering. A request to a public endpoint.

The second repeat is where the bugs live. Forms and uploads, over and over: Forminator, Gravity Forms, JetFormBuilder, the Elementor Forms uploader, Mail Mint. A form is a public endpoint that accepts structured input from strangers by design, so it is where a validation mistake costs the most.

Which points at a cheap piece of hardening that has nothing to do with any of these CVEs: ask your host whether PHP executes under wp-content/uploads. Where it does not, a file upload bug drops an inert file instead of a shell. Respira's security audit tests this directly rather than guessing from configuration files, by writing one harmless file, requesting it over HTTP and deleting it.

Checking your own sites

Reading a list like this and mentally matching it against twenty client sites is where the whole exercise falls over. Nobody remembers which site has Amelia on it.

Respira's WordPress vulnerability scanner compares every plugin, theme and core version on every connected site against this whole database, refreshed every six hours, and lists only what applies to the versions installed, each with the version that fixes it and a link to its record. A scan stored last week is re-checked against today's database, so a record published this morning reaches yesterday's scan.

Fixing is approval-gated. The agent proposes the exact update, you approve it in WordPress, and a second scan produces the receipt. Nothing updates because an AI decided it should.

One honest limit, repeated from every page here that touches this: a version number tells you what is exposed now. It cannot tell you whether something came through before you updated. Those are two questions, and only the first one has a cheap answer.

Checked on 22 September 2026.