201 WordPress Vulnerabilities in One Week: March 2-8 2026 Roundup

Wordfence's weekly WordPress vulnerability digest for 2-8 March 2026 logged 201 disclosed vulnerabilities across 84 plugins and 107 themes. Of those, 60 were rated critical severity. That is a significant volume for a single week - and it comes on top of several high-profile individual disclosures already covered this month, including the Ally plugin SQL injection and the WordPress core triple patch release.

What the Numbers Mean

201 disclosures in one week does not mean 201 sites were compromised. It means 201 vulnerabilities were formally reported, researched, and added to public tracking databases during that period. Many will be patched quickly; some will not. The risk is concentrated in:

• Plugins with large install bases - a vulnerability in a plugin with 100,000+ active installs represents a wide attack surface even if exploitation is technically complex
• Unauthenticated vulnerabilities - any flaw that can be exploited without a WordPress account is immediately actionable for automated scanners
• Themes - theme vulnerabilities are often overlooked in patching workflows because theme updates are treated as cosmetic rather than security-critical

The 60 critical-severity entries in this week's digest represent vulnerabilities rated CVSS 9.0 or above. At that score, the expectation is that exploitation is straightforward and impact is severe - typically full site compromise, data exfiltration, or remote code execution.

What to Do

If you manage WordPress sites, the practical response to a week like this is not to read every advisory individually. It is to have the infrastructure in place so you do not need to:

• Enable automatic updates for plugins and themes where your tolerance for breaking changes allows it
• Run a managed WAF (Wordfence, Patchstack, or similar) that applies virtual patches between disclosure and update
• Review your active plugin list - every installed plugin is a potential attack surface, whether it is active or not
• Treat theme updates as security-critical, not optional cosmetic changes

The volume of WordPress vulnerability disclosures is not going down. The teams that absorb it best are those with automated patching and a WAF layer doing the heavy lifting between disclosure and deployment.