Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

WordPress patched CVE-2026-87902 on September 22, 2026. Attackers were exploiting it the same day. Within hours of disclosure, attackers progressed from reconnaissance to active exploitation attempts, including attempts to write malicious PHP files to disk. The vulnerability is critical, with a CVSS v4.0 score of 9.2. Unauthenticated attackers can exploit it remotely. A public scanning template is already in circulation, and CISA has added the vulnerability to its KEV catalog.

Two-factor authentication (2FA) gives your WordPress login an extra verification step beyond the password. If someone gets hold of a password, they still need the second factor to access the account. This makes 2FA particularly useful for administrators, editors, store managers, members, and other users with access to important site functions. The right 2FA plugin depends on your site, user base, and the level of control you need over 2FA.

Connecting ChatGPT, Claude, or another AI agent to WordPress can turn simple instructions into real website actions. An agent can create posts, update pages, upload media, manage orders, and handle other tasks when the right MCP tools are available. The interesting part starts when you decide how much access to give it. A content management agent may need posts and media, while a WooCommerce support agent may need orders and customer information.

Publishing great content is the hard part. Getting it in front of readers is the fun part, and that's exactly what SEO is built to do: it's the technical and structural work that helps search engines find your content, understand it, and put it in front of the people searching for it. For bloggers running WordPress, there's a real opportunity here.

A newly disclosed WordPress exploit chain, nicknamed “WP2Shell,” lets unauthenticated attackers achieve remote code execution (RCE) on any WordPress Core installation, no plugins required. Disclosed on July 17, 2026, the chain combines two vulnerabilities: CVE-2026-60137 (SQL injection) and CVE-2026-63030 (REST API batch-route confusion).

SQL injections are still among us. On July 17, WordPress released an emergency security update. Version 7.0.2 fixes an unauthenticated remote code execution flaw in WordPress core that an anonymous attacker can trigger against a stock install with no plugins involved. If your site runs an affected version, update today. WordPress.org has turned on forced auto-updates for affected sites because of how severe this is. We are tracking this vulnerability in Aikido Intel.

Cloudflare has deployed new Web Application Firewall (WAF) protections for two critical vulnerabilities affecting WordPress. The protections address an Unauthenticated Remote Code Execution (RCE) vulnerability in WordPress's REST API and a related SQL Injection vulnerability. The WordPress security team disclosed the vulnerabilities to Cloudflare before public release so that we could prepare protections for customers.

WordPress sites are adopting AI faster than any other web technology category, and the impact is already visible. Over 61% of WordPress site owners now use at least one AI tool for content creation or marketing. WordPress teams are using that access to write content, automate workflows, run chatbots, and process customer data at a scale that was simply not possible before. But as AI adoption grows, so does the risk.

In 1997, IBM’s Deep Blue, the first AI agent, made history by defeating Garry Kasparov at chess. Since then, AI agents have advanced dramatically, evolving from single‑task systems to agents like OpenAI’s Operator, which can autonomously fill out forms, place orders, and schedule appointments. WordPress is a popular CMS that powers more than 20% of the top one million websites. Bringing AI agents into WordPress opens up new possibilities, making sites more capable and adaptive.