BackWPup for backups. CleanTalk for spam. Two plugins installed to protect a site received vulnerability reports in the same week. Here is what the 26-item weekly list actually tells us.
WordPress plugin vulnerabilities ran to more than 250 a week in 2026. Forty-three per cent need no login at all, and twenty-three per cent are still unpatched thirty days after a fix exists. The gap, not the flaw, is the problem.
In July 2026, an unauthenticated remote code execution flaw (wp2shell) was found in WordPress core, prompting an emergency patch, while a string of vulnerabilities that hand over entire admin accounts were disclosed in popular plugins. Here are the key facts and what to do.
https://asec.ahnlab.com/ko/94512/
THEVOS
One tap to launch — just like a native app
