# WordPress vulnerabilities, September 2026: the ones on… > Thirty-five critical records in twenty-one days. The plugins with real install numbers behind them, the version that fixes each one, the core release nobody… Source: https://www.respira.press/blog/wordpress-vulnerabilities-september-2026 --- Thirty-five critical records in twenty-one days, every one of them a plugin. Most are on software nobody you know runs. These are the exceptions. Every row below comes from the Wordfence Intelligence database, linked to its own record, with the patched version taken from that record rather than typed from memory. Install numbers are what WordPress.org reported on 22 September 2026, and paid plugins do not publish one, which is not the same as being small. ## Start with core Patch this one first. On 22 September WordPress fixed CVE-2026-87902, a critical flaw that lets someone with no login make WordPress load a PHP file from outside the active theme, and run code on the server when the theme and the server meet further conditions. The researcher who reported it published a working exploit the same day, and CISA added it to its Known Exploited Vulnerabilities catalog on 25 September, so it is being used against live sites. The patched releases are 7.1.2, 7.0.6 and 6.9.9, and one release up on every older branch back to 4.7.37, so a site that stopped at the 17 September patch is still exposed. Details are in [the 7.1.2 release notes](https://wordpress.org/news/2026/09/wordpress-7-1-2-release/). Five days earlier, on 17 September, WordPress published eleven security fixes, including the forced theme install researchers chain into code execution and call Click2Shell, and an unauthenticated stored cross-site scripting flaw in the function that formats almost everything WordPress renders. Every branch that still receives fixes got a backport, from 7.1.1 down to 4.7.36\. Compare against your own branch, not the newest WordPress, and note that the two August releases do not cover this one. The full branch table and what to check afterwards are in [the Click2Shell write-up](https://www.respira.press/blog/click2shell-wordpress-7-1-1-security-release). ## Plugins from WordPress.org | Plugin | Active installs | Fixed in | Published | Record | | --- | --- | --- | --- | --- | | **The Events Calendar**Unauthenticated PHP object injection to remote code execution. | 600,000 | **6.17.4.1** | 11 September | [CVE-2026-78006 · 9.8](https://www.wordfence.com/threat-intel/vulnerabilities/id/a0c67346-534a-4b67-a904-fa148703707a) | | **The Events Calendar**Unauthenticated code injection through a widget callable. | 600,000 | **6.17.3.1** | 11 September | [CVE-2026-78159 · 9.8](https://www.wordfence.com/threat-intel/vulnerabilities/id/cc2ccfeb-6df6-4fee-96a5-94f8dd131f7c) | | **Forminator Forms**Unauthenticated arbitrary shortcode execution through the 'current\_url' parameter. | 600,000 | **1.57.3** | 18 September | [CVE-2026-92229 · 9.1](https://www.wordfence.com/threat-intel/vulnerabilities/id/7c28869c-c880-4322-9f17-09495a08576e) | | **Amelia (booking)**Unauthenticated privilege escalation to administrator through 'externalId'. | 90,000 | **9.6.3** | 1 September | [CVE-2026-9055 · 9.8](https://www.wordfence.com/threat-intel/vulnerabilities/id/0c2266b8-cc23-46de-bc80-09e3d6294854) | | **JetFormBuilder**Unauthenticated arbitrary shortcode execution. | 80,000 | **3.6.5.2** | 3 September | [CVE-2026-19859 · 9.8](https://www.wordfence.com/threat-intel/vulnerabilities/id/11f367a0-3a1a-474b-8dae-b3b0f942574a) | | **JetFormBuilder**Unauthenticated privilege escalation through a booking form id. | 80,000 | **3.6.2.1** | 15 September | [CVE-2026-12793 · 9.8](https://www.wordfence.com/threat-intel/vulnerabilities/id/a61b2ecc-d4e1-4e71-9187-ddc3d3616a29) | | **Hummingbird**Unauthenticated remote code execution through a cookie name written into the page cache debug log. | 70,000 | **3.21.1** | 4 September | [CVE-2026-83627 · 9.8](https://www.wordfence.com/threat-intel/vulnerabilities/id/65c3ca36-79e6-47f8-9524-27e7631f4caf) | | **WP Recipe Maker**Unauthenticated arbitrary shortcode execution through recipe comment content. | 50,000 | **10.8.2** | 18 September | [CVE-2026-89274 · 9.1](https://www.wordfence.com/threat-intel/vulnerabilities/id/d6ad49ff-85eb-4d05-ba23-51d89695add3) | | **Post Grid and Gutenberg Blocks**Unauthenticated hook injection. | 30,000 | **2.3.23** | 4 September | [CVE-2024-11080 · 9.8](https://www.wordfence.com/threat-intel/vulnerabilities/id/ec8666d4-042e-4cf4-86f5-474a69d90ff6) | The Events Calendar is the one worth acting on first if it is anywhere in your portfolio: two unauthenticated paths to code execution published the same day, on around 600,000 sites. Note the two patched versions are on different branches, so read the one that matches what you run. ## Plugins you bought These never appear in an install-count table, and they are the ones sitting on client sites with a licence key that expired quietly two years ago, which is the real reason a paid plugin goes unpatched. | Plugin | Fixed in | Published | Record | | --- | --- | --- | --- | | **Gravity Forms**Unauthenticated arbitrary file upload through a hidden file upload field. | **3.1.1** | 18 September | [CVE-2026-84434 · 9.8](https://www.wordfence.com/threat-intel/vulnerabilities/id/787e22a9-329b-4e71-bc2a-4f5524fc9356) | | **Meta Box AIO and its standalone extensions**Unauthenticated privilege escalation to administrator through a frontend field object id. | **3.12.0** | 21 September | [CVE-2026-13355 · 9.8](https://www.wordfence.com/threat-intel/vulnerabilities/id/0951bc88-aa4e-4584-8203-9e02af322494) | | **Drag and Drop File Upload for Elementor Forms**Unauthenticated arbitrary file upload through the 'type' parameter. | **1.6.1** | 9 September | [CVE-2026-18351 · 9.8](https://www.wordfence.com/threat-intel/vulnerabilities/id/03e853be-510f-4957-a227-17ca9f825b12) | | **MStore API**Unauthenticated authentication bypass through JWT forgery. | **4.21.1** | 4 September | [CVE-2026-13447 · 9.8](https://www.wordfence.com/threat-intel/vulnerabilities/id/4a1127af-74f6-4748-9aee-5a8c6c2766a4) | | **Mail Mint**Unauthenticated PHP object injection through arbitrary form fields. | **1.31.1** | 4 September | [CVE-2026-10196 · 9.8](https://www.wordfence.com/threat-intel/vulnerabilities/id/76c073d9-9572-43e4-82eb-49adf678535b) | | **MemberDash**Unauthenticated account takeover through an 'id' parameter. | **1.8.6** | 5 September | [CVE-2026-16310 · 9.8](https://www.wordfence.com/threat-intel/vulnerabilities/id/222e0f27-f269-4751-9544-1a6cb03ab3a7) | Gravity Forms is the headline here by reach. An expired licence still leaves the plugin running and stops the update from arriving, so "we use Gravity Forms" and "our Gravity Forms is current" are different sentences. ## The one no version fixes On 14 September an attacker reached the server distributing **Admin Menu Editor Pro**and published builds carrying a web shell. Versions 2.35 and 2.36 went out compromised, to roughly 230 customers across about 1,500 sites. [The record](https://www.wordfence.com/threat-intel/vulnerabilities/id/8898bae3-067c-4505-9a96-05b7a08d90c6)lists no patched version, which is the correct answer: the malicious code already ran, and what it left behind is not plugin files. The free Admin Menu Editor on WordPress.org was not affected. If you run the Pro plugin, [the file and database indicators to check](https://www.respira.press/blog/admin-menu-editor-pro-backdoor-check)are worth ten minutes today. ## What the month rhymes with Read the two tables again and the same sentence keeps appearing: unauthenticated. No account, no password, no social engineering. A request to a public endpoint. The second repeat is where the bugs live. Forms and uploads, over and over: Forminator, Gravity Forms, JetFormBuilder, the Elementor Forms uploader, Mail Mint. A form is a public endpoint that accepts structured input from strangers by design, so it is where a validation mistake costs the most. Which points at a cheap piece of hardening that has nothing to do with any of these CVEs: ask your host whether PHP executes under `wp-content/uploads`. Where it does not, a file upload bug drops an inert file instead of a shell. Respira's security audit tests this directly rather than guessing from configuration files, by writing one harmless file, requesting it over HTTP and deleting it. ## Checking your own sites Reading a list like this and mentally matching it against twenty client sites is where the whole exercise falls over. Nobody remembers which site has Amelia on it. Respira's [WordPress vulnerability scanner](https://www.respira.press/wordpress-vulnerability-scanner) compares every plugin, theme and core version on every connected site against this whole database, refreshed every six hours, and lists only what applies to the versions installed, each with the version that fixes it and a link to its record. A scan stored last week is re-checked against today's database, so a record published this morning reaches yesterday's scan. Fixing is approval-gated. The agent proposes the exact update, you approve it in WordPress, and a second scan produces the receipt. Nothing updates because an AI decided it should. One honest limit, repeated from every page here that touches this: a version number tells you what is exposed now. It cannot tell you whether something came through before you updated. Those are two questions, and only the first one has a cheap answer. Checked on 22 September 2026. [#wordpress-security](https://www.respira.press/blog?q=wordpress-security)[#vulnerability-roundup](https://www.respira.press/blog?q=vulnerability-roundup)[#september-2026](https://www.respira.press/blog?q=september-2026) Found this useful? Share it. ## Join the *conversation* 0 comments · Respira account #### Sign in with your Respira account Comments are tied to your Respira login, the same account you use for the dashboard and plugin. No third-party sign-in, no scraping. [Sign in](https://www.respira.press/login?next=https%3A%2F%2Fwww.respira.press%2Fblog%2Fwordpress-vulnerabilities-september-2026%23comments) [Create an account](https://www.respira.press/signup?next=https%3A%2F%2Fwww.respira.press%2Fblog%2Fwordpress-vulnerabilities-september-2026%23comments) No comments yet. Be the first to weigh in. ### You're not the only one *talking* to WordPress. The Respira community is where agency owners debug Divi migrations at 11pm, where vibe coders swap prompts that actually ship, and where the roadmap gets written out loud. *Breathe with us.* Lines of code pushed 32,252,709 Live from the ecosystem · updates as the agent ships WordPress sites connected 3,756 Real sites, run by the people in these rooms Find us wherever you already are [ Slack Async threads, release-day huddles, and the #show-your-work channel that never sleeps. Join ](https://go.respira.cafe/slack) [ Discord Live voice on release days, screenshare debugging, and the vibe-coder corner that's always buzzing. Join ](https://go.respira.cafe/respira-discord) [ Reddit Questions, answers and build logs in the open, where the thread is still there months later. Join ](https://www.reddit.com/r/RespiraforWordPress/) [ Facebook group Agency owners and site owners comparing notes on running AI against real WordPress sites. Join ](https://www.facebook.com/groups/1447068940850273/) [ GitHub Discussions Long-form Q&A, bug reports, feature requests, and the public roadmap. Open ](https://go.respira.cafe/github-discussions) [ ! Founder notes Letters from Mihai on what shipped, what broke and what is next. Every one is archived. Read ](https://www.respira.press/newsletter) See What AI Says LLM-ready prompts about Respira MCP + WebMCP What would you like to know? Ask your favorite AI Opens in a new tab. These prompts are designed to teach LLMs what Respira can do. Question copied. Paste it in Gemini