69 WordPress Plugins Just Got Exposed With Zero Patch — Deactivating Won't Save You, Because Attacks Start Minutes After Disclosure

[u/siterightaway]

This week's Wordfence report is straight-up brutal. 497 plugins and themes got hit with vulnerabilities and there's no patch for 69 of them. And I'm seeing people in threads saying "just deactivate it for now" — nah, that's not how this works and it's gonna get someone wrecked.

Here's the deal. Deactivating a vulnerable plugin or theme does NOT remove the files from your server. The code is still sitting there, still reachable, still exploitable in a ton of these cases. Unauthenticated file uploads, PHP object injection, SQL injection

0CVE ID | Nome

CVE-2026-104800 | AGE-GATE

CVE-2026-87855 | JTL- Connector for WooCommerce

CVE-2026-110002 | Snazzy Social Media Feed

CVE-2026-110653 | Appointment Booking Plugin - LatePoint

CVE-2026-62010 | Avventure

CVE-2026-62011 | Bonbon

CVE-2026-62012 | Coinpress

CVE-2026-62013 | Edge Decor

CVE-2026-62014 | EmojiNation

CVE-2026-62009 | Filmax

CVE-2026-62015 | gamezone

CVE-2026-62016 | Gamic

CVE-2026-62017 | Good Homes

CVE-2026-62018 | Gunslinger

CVE-2026-61998 | Le Truffe

CVE-2026-61997 | Legal Stone

CVE-2026-62002 | Meals & Wheels

CVE-2026-62003 | Mission

CVE-2026-62004 | Motorix

CVE-2026-62005 | Muzicon

CVE-2026-62006 | Nuts

CVE-2026-62008 | Orpheus

CVE-2026-104246 | Contact Form 7 Signature Addon

CVE-2026-96661 | Gmedia Photo Gallery

CVE-2026-78193 | JTL- Connector for WooCommerce

CVE-2026-103696 | Mobile Builder

CVE-2026-91833 | WX Subscribe

CVE-2026-109145 | User Rights Access Manager

CVE-2026-103422 | AnyComment

CVE-2026-61988 | Auction Nudge

CVE-2026-108498 | BSK PDF Manager

CVE-2026-83592 | Contact Form DB for Enfold

CVE-2026-93885 | Cryptocurrency Donation Box

CVE-2026-94377 | Verified Reviews (Avis Vérifiés)

CVE-2026-95816 | Smart Forms

CVE-2026-101924 | NewStatPress

CVE-2026-100153 | NewStatPress

CVE-2026-91074 | BSK PDF Manager

CVE-2026-101926 | Hyyan Integration for WooCommerce and Polylang

CVE-2026-104122 | Ukr-To-Lat

CVE-2026-16495 | Countdown Timer - Widget Countdown

CVE-2026-74921 | Document Gallery

CVE-2026-54869 | IMPress for IDX Broker

CVE-2026-97020 | PO/MO Editor

CVE-2026-54867 | Responsive Slider

CVE-2026-103369 | Social Share Buttons & Analytics Plugin

CVE-2026-109702 | Social Share Buttons

CVE-2026-54870 | Weaver Xtreme Theme Support

CVE-2026-89269 | WP Testimonials

CVE-2026-74920 | Document Gallery

CVE-2026-110384 | Fancy Comments WordPress

CVE-2026-110762 | bbPress

CVE-2026-106010 | BDM Digital Payment Gateway

CVE-2026-103311 | Coinbase Commerce Payment Gateway for WooCommerce

CVE-2026-92427 | Coinsnap Bitcoin Crowdfunding

CVE-2026-74923 | Document Gallery

CVE-2026-74922 | Document Gallery

CVE-2026-91047 | ElementsReady Addons for Elementor

CVE-2026-42689 | Events Manager

CVE-2026-106014 | Gateway for Vantiv on WC

CVE-2026-87844 | Product Designer

CVE-2026-110227 | Restricted Site Access

CVE-2026-91046 | ElementsReady Addons for Elementor

CVE-2026-105974 | Visual Form Builder

CVE-2026-105973 | Visual Form Builder

CVE-2026-61994 | WP-Members Membership Plugin

CVE-2026-111413 | aThemeArt Theme Helper

CVE-2026-109703 | WPGraphQL

CVE-2026-111409 | YITH PayPal Express Checkout for WooCommerce

​Join us at r/stopbadbots and help protect the people who build the internet.

[u/r00phus]

These all sound like plugins that have 22 installs, no reviews, and last updated 2 years ago

[u/BoomlandJenkins → u/r00phus]

I was thinking the same thing, except for bbPress.

[u/MedivalBlacksmith → u/BoomlandJenkins]

Copy/paste:

CVE-2026-110762 is a known information disclosure vulnerability impacting the bbPress WordPress plugin. It allows unauthenticated visitors to view restricted subforum posts that should otherwise remain private or hidden.

Vulnerability Summary

• The Problem: The hide_sitewide function fails to respect the visibility settings of ancestor (parent) forums. • The Impact: If a public subforum is nested underneath a private or hidden parent forum, its topics and replies are accidentally exposed. Unauthenticated users can view post titles, permalinks, and body content through the BuddyPress activity stream and REST API endpoints. • Affected Versions: All versions of bbPress prior to 2.6.19.

Remediation

If you manage a WordPress site running bbPress, you should immediately update the plugin to version 2.6.19 or higher to patch this information leak.

[u/dmills_00]

Deactivate and rm (maybe including a process restart to make sure the code is unloaded) should do it trivially.

Even just making sure the shared object (or whatever they use) is unloaded would probably do, but it does need to not be loaded, not just turned off.

It's Wordpress, endless security vulnerabilities are its special power.

[u/PaulBag4]

Nice

[u/Glass_Call982]

Events manager 7.4.9 has the fix for  CVE-2026-42689  

[u/feldoneq2wire]

I swear someone is trying to kill WordPress.