Wordfence Intelligence Weekly WordPress Vulnerability Report (September 7, 2026 to September 13, 2026)

Flaws in The Events Calendar WordPress plugin enable unauthenticated RCE

Unauthenticated RCE Flaws Could Expose 200,000+ WordPress Sites to Takeover

Attackers Exploit WooCommerce Wholesale Lead Capture Flaw to Plant PHP Web Shells

Wordfence Argus Identifies Two Critical Unauthenticated Vulnerability Chains Leading to Remote Code Execution in The Events Calendar Plugin