20 October 2026
WordPress security is back under the spotlight after a string of high-profile flaws and supply chain attacks hit the open-source platform and its vast plugin ecosystem. Recent incidents confirm that attackers targeting vulnerabilities in WordPress are exploiting weaknesses in software used by millions of websites. Multiple cases have already left thousands of organizations exposed.
WordPress 6.4.3 Maintenance and Security Release
WordPress 6.4.3 addresses multiple security issues, including a critical XSS vulnerability in the Comments administration panel. The update resolves several major security flaws that were actively being exploited.
The latest WordPress release fixes a stored cross-site scripting (XSS) vulnerability that allowed malicious scripts in comments to execute when viewed by administrators. Unlike reflected XSS attacks, stored payloads remain persistent until manually removed.
The update also patches a denial-of-service vulnerability in the URL handling functions and a second-order SQL injection in the WXR export feature. These issues demonstrate the diverse security challenges facing WordPress developers, where even minor oversights can create significant attack surfaces.
The stored XSS vulnerability represents a particularly common threat. Attackers embed malicious JavaScript in comments that executes with admin privileges when loaded in the dashboard.
Beyond fixing XSS, DoS, and SQL injection flaws, the update addresses several privilege escalation issues. These include preventing Author-level users from sticky posting and blocking unauthorized access to comments on unpublished posts. The patch also eliminates potential parameter forgery in certain hook implementations.
Security advisories indicate that multiple threat actors are exploiting misconfigured workflows in WordPress installations. Attackers appear to be leveraging lax branch protection rules and unmaintained dependencies to establish initial access.
Independent vulnerability trackers have documented authenticated stored XSS cases along with numerous SQL injection and CSRF-to-XSS flaws across popular plugins.
Researchers at Cloudflare recently disclosed a critical SQL injection vulnerability affecting WordPress 6.3 and later versions, along with a serious remote code execution (RCE) flaw in version 6.4. The RCE vulnerability becomes particularly dangerous when sites disable object caching during scaling operations.
Security platforms reported approximately 6,000 new WordPress vulnerabilities in 2023, with 94% originating from plugins rather than core files.
The volume of vulnerabilities is matched by active exploitation attempts. Security agencies recently confirmed attackers are weaponizing WordPress flaws tracked as CVE-2023-2745 and CVE-2023-2987 in active campaigns, adding them to known exploited vulnerability catalogs.
More on this is available via top mobile casino apps for New Zealand players 2026.
Recommended security measures include implementing CAPTCHA systems, enforcing two-factor authentication, and maintaining current software versions. Restricting file editing capabilities for non-administrative users can block many common attack vectors.
However, WordPress' existing security controls continue to show vulnerabilities. Recent incidents have exposed concerning cases of plugin supply chain compromises that breach established trust models.
In these attacks, threat actors hijack developer accounts or abuse ownership transfers to inject malicious code into widely distributed plugins.
This attack vector has grown increasingly prevalent since mid-2023, when a major incident impacted over 10,000 websites. The campaign involved backdoored versions of multiple popular plugins, representing a significant breach of supply chain trust.
One affected plugin suite with more than 300,000 active installations became the vector for an ownership transfer attack. The original developer transferred control to a malicious entity through seemingly routine updates.
Early version changelogs contained innocuous update notes while silently introducing the ownership change. The malicious functionality remained dormant until triggered by a subsequent update months later.
Security teams recommend monitoring plugin changelogs for unusual ownership changes or compatibility notes that might signal supply chain compromises.
The combination of frequent vulnerabilities and sophisticated supply chain attacks creates mounting challenges for WordPress administrators. As attackers refine their techniques, defenders must adopt increasingly vigilant security postures.
The most significant lesson may be for open-source ecosystems to implement stricter controls around ownership transfers and code commit privileges.
