WordPress Vulnerabilities – June 4, 2026 to June 18, 2026
Introduction: Keeping your WordPress site secure is essential. In this post, you’ll find a summary of the latest plugin vulnerabilities discovered over the past two weeks, so you can take action and stay protected.
WP Maps Pro
Summary: An unauthenticated privilege escalation vulnerability allows remote threat actors to bypass authorization steps via the `wpgmp_temp_access_ajax` AJAX action, enabling them to create unauthorized administrator accounts and gain full access to the site.
Affected Versions: 6.1.0 and earlier
Source: View details
UpdraftPlus: WP Backup & Migration Plugin
Summary: A critical unauthenticated authentication bypass flaw was discovered via the UpdraftCentral `udrpc` handling mechanism. This allows external actors to circumvent standard authentication controls and potentially compromise backup files and configurations.
Affected Versions: 1.26.4 and earlier
Source: View details
Kirki Customizer Framework
Summary: An unauthenticated privilege escalation flaw allows remote attackers to arbitrarily reset or change administrator passwords. This creates an immediate risk of absolute administrative account takeovers.
Affected Versions: 6.0.0 through 6.0.6
Source: View details
CF7 to Webhook
Summary: An unauthenticated Server-Side Request Forgery (SSRF) flaw allows attackers to force the underlying web application to send forged HTTP requests. This happens due to insufficient input validation within the field placeholder parsing framework for webhook configurations.
Affected Versions: All versions up to, and including, 5.0.0
Source: View details
Conclusion: Make sure to update any affected plugins and monitor your site regularly. Staying informed is one of the best ways to protect your WordPress installation.