Company
Defiant Inc. is a security company that makes Wordfence, a widely used firewall and malware-scanning plugin for WordPress sites.
Artifex fixed Ghostscript CVE-2026-39919 in 10.08.0 on September 8, closing a heap overflow present in versions 9.21 through 10.07.1. Wordfence, which found the flaw, has seen no exploitation in the wild yet.
Reality
Unauthenticated attackers can drop PHP onto WordPress sites running Forminator 1.56.1 or earlier. The install base is 600,000; the exposed subset depends on how the forms were built.
Reality
Wordfence has blocked nearly 200,000 attempts against CVE-2026-32475 since August 19. Because the payload is a PHP file already sitting in the uploads tree, upgrading to 4.2.2 tells you nothing about whether you were hit.
Perspective Coverage
3 publishersReality
CVE-2026-27540 lets an unauthenticated request add php to the plugin's own upload allowlist and drop a webshell. The fix shipped on February 20, and the first exploitation spike came 104 days later, on June 4.
Perspective Coverage
3 publishersReality
StellarWP split the fix across two releases, so a WordPress site updated on August 25 stayed open to CVE-2026-78006 until 6.17.4.1 shipped on September 10. Version data puts about 240,000 installs behind both bugs.
Reality
Onapsis found CVE-2026-44756 in SAP's Extended Passport code, Pathlock and nullFaktor reproduced remote code execution in a lab, and technical write-ups went public within 48 hours of the patch. Mandiant's AI report is the week's other substance.
Reality
Wordfence says CVE-2026-18431 lets an unauthenticated attacker run PHP on sites running both a vulnerable Avada theme and Fusion Builder. Updating either component breaks the chain.
Reality