You didn't ask for a security bulletin. You asked your site to sell things, book appointments, or just sit there looking professional. But once a week, a security company called Wordfence publishes a tally of every newly disclosed WordPress plugin and theme vulnerability — and that tally is the reason your updates screen keeps nagging you.
For the week of 31 August to 6 September 2026, the Wordfence Intelligence weekly report counted 277 vulnerabilities across 187 plugins and 7 themes, submitted by 153 researchers. Of those, 254 already had a fix available when the report went out. 23 did not.
That sounds alarming. Most of it isn't. Here's the part that actually matters for a site owner.
First, two words worth knowing
A CVE is just a catalogue number — a unique ID assigned to one specific flaw so that everyone refers to it by the same name. CVE-2026-83627 is a label, not a threat level.
The threat level is the CVSS score, a rating from 0 to 10. Anything 9.0 or above is called critical, which in practice usually means an attacker needs no password and no account to pull it off. Those are the ones worth interrupting your week for. A 5.3 that requires an administrator login is a different conversation.
The word to watch in any advisory is unauthenticated. It means the attacker does not need to log in. They don't need to guess your password, because they never reach the login screen.
The three critical ones
Hummingbird Performance — CVE-2026-83627 (9.8)
Hummingbird is a caching and speed plugin. Versions up to and including 3.21.0 contain a flaw that lets an unauthenticated attacker run their own PHP code on your server — the worst category of outcome, because from there they effectively own the site. The bug lives in the debug log: a protective header that should stop that log file from being executed wasn't being written, and the attacker's code arrives disguised as a cookie name.
The fix is version 3.21.2, released 1 September 2026. Details are in the NVD record for CVE-2026-83627 and the plugin's own changelog.
This one only bites if you have Page Caching switched on and Debug Log enabled alongside it. That is not the default, so most Hummingbird sites were never exposed. Update anyway — it takes a minute, and that's quicker than working out which camp you're in.
Mail Mint — CVE-2026-10196 (9.8)
Mail Mint is an email marketing plugin. All versions up to and including 1.31.0 are vulnerable to PHP object injection through the form submission handler. Object injection is a flaw where data you type into a form gets rebuilt by the server into live code objects instead of being treated as plain text — and on the wrong site, that ends in code execution. No login required.
Here the picture is less tidy, and it's worth saying so plainly. The NVD record for CVE-2026-10196 does not name a fixed version. The plugin's changelog for 1.31.1, released 1 September 2026, says custom field submissions can no longer be used to instantiate arbitrary PHP objects — which reads like the fix for exactly this issue. The current release is 1.31.2. Get onto 1.31.1 or later; we could not confirm from a primary source that a specific version is the designated patch.
ACPT (Premium) — CVE-2026-15354 (9.8)
ACPT is a custom content type builder. In versions up to and including 2.0.66, an unauthenticated visitor can choose which user account a form submission updates and then overwrite that account's credentials — including an administrator's. That's privilege escalation: a stranger promoting themselves to owner of your site. The NVD record for CVE-2026-15354 has the technical detail.
Because ACPT Premium is a paid plugin, it doesn't update through the WordPress.org directory, so it may not appear in your normal updates list at all. The CVE record names no fixed version, though Wordfence lists the issue as patched — so log into your ACPT account and install the latest build rather than trusting a version number from us.
Two more worth the same five minutes
Neither is critical, but both were disclosed in the same week and both are quick:
- Advanced Custom Fields: Extended — CVE-2026-12526, rated 8.1. Versions before 0.9.2.7 didn't properly check that whoever submitted a front-end user form was actually allowed to edit the account they were editing. Fixed in 0.9.2.7.
- JetFormBuilder — CVE-2026-19859, rated 6.5. Versions before 3.6.5.2 let an unauthenticated visitor trigger shortcodes on any page displaying a form. Fixed in 3.6.5.2.
You'll notice a theme running through the week. Forms. Anything that accepts input from a stranger is where the bugs are, because that's where the strangers are.
What about the 23 with no fix?
This is the question that actually deserves your attention, because updating doesn't help.
The reassuring part: nothing in the unpatched group was rated critical. The most severe was an 8.1 in JobSearch WP Job Board (versions up to 3.2.0), with the rest at 7.3 and below — including Rest Routes up to 5.5.5 and Ninja Forms File Uploads up to 3.3.26. All of them are listed in the Wordfence report linked above.
When a plugin has a disclosed flaw and no update, you have three honest options, in order of preference. Deactivate and delete it, if you don't genuinely need it. Replace it with a maintained alternative. Or accept the risk knowingly and put a web application firewall in front of it while you wait for the developer. "Wait and hope" is not one of the three.
Deactivating a plugin is not the same as deleting it. A deactivated plugin's files still sit on your server and can still be reachable. If you've decided you don't need it, delete it properly.
What to do this week
- Take a backup first, and check that it actually downloaded. Everything below is safer with one sitting on your own machine.
- Open Dashboard → Updates and apply your plugin updates. Specifically: Hummingbird to 3.21.2 or later, Mail Mint to 1.31.1 or later, ACF Extended to 0.9.2.7 or later, JetFormBuilder to 3.6.5.2 or later.
- Update your paid plugins separately. They don't appear in that list. ACPT is this week's example, but the principle is permanent — premium plugins are the ones that quietly rot.
- Count the plugins you don't recognise or haven't used in a year, and delete them. Every plugin you remove is one you never have to patch again.
- Click through your contact and booking forms afterwards to confirm they still submit. Form plugins were most of this week's news, and they're also the thing most likely to break quietly after an update.
None of that needs a developer. It needs about twenty minutes, and someone remembering to do it every week — which is the part that tends to go wrong. The risk is rarely one dramatic flaw. It's the eleven months of skipped updates sitting behind it.
If you'd rather this simply happened — updates applied, backups verified, the release notes read by someone whose job it is to read them — that's the unglamorous work we do for the sites we look after. Either way, do step one today.
Next step
Find out what a scanner sees on your site.
Run a free, non-invasive scan in about a minute. You'll get a plain-English security grade and the fixes that matter, no signup required.