WordPress Vulnerabilities: August 2026 Roundup

Last updated: August 24, 2026

Three WordPress vulnerabilities dominated August 2026: the BdThemes supply-chain attack affecting 350,000+ installs, Forminator’s unauthenticated file upload flaw (CVE-2026-15748, CVSS 9.8) exposing around 300,000 sites, and an authentication bypass in User Profile Builder (CVE-2026-15826, CVSS 9.8) affecting 40,000+ sites.

This roundup covers the three incidents with the widest blast radius and the clearest action for site owners. It is not an exhaustive CVE list — dozens of lower-severity plugin advisories ship every month — but if you only have an hour this month, these are the three to spend it on.

What should I patch first?

Patch in order of exposure, not CVSS score. Deactivate BdThemes plugins first because no fix exists, then update Forminator, then User Profile Builder. The two CVEs have patches available today; the supply-chain incident does not, which makes it the only one where updating is not an option.

Priority	Issue	Severity	Sites affected	Action
1	BdThemes supply-chain attack	No CVE assigned	350,000+	Deactivate — no patch available
2	Forminator CVE-2026-15748	CVSS 9.8	~300,000 vulnerable	Update to 1.56.2+
3	User Profile Builder CVE-2026-15826	CVSS 9.8	40,000+	Update to 3.16.5+

Note the mismatch between severity score and priority. BdThemes carries no CVE and Wordfence rated the underlying flaw only medium, yet it ranks first here because it was actively exploited and has no fix. CVSS measures theoretical impact; exploitation status and patch availability decide what you do on a Monday morning.

What happened in the BdThemes supply-chain attack?

An attacker compromised BdThemes’ infrastructure and poisoned a JSON feed its Elementor add-ons fetch for promotional banners. Loading any wp-admin page executed attacker script in the administrator’s browser, creating hidden admin accounts and installing an emer-run.php webshell. Wordfence detected it on August 7, 2026.

What makes this the month’s most important story is that no files on disk changed. File-integrity monitoring, checksum comparison against WordPress.org, and “is my plugin up to date” checks all report a clean site. Seven plugins were pulled from the repository on August 8 pending review.

Full detail, indicators of compromise and the detection commands are in our report on the BdThemes hack and how to check your site for rogue admins.

How serious is the Forminator vulnerability?

Serious but conditional. CVE-2026-15748 lets an unauthenticated attacker upload executable files, but exploitation requires a published form containing both a File Upload field and a Select field. Sites on Forminator’s default upload storage are protected from code execution; sites using a custom storage path face full remote code execution.

The patch landed in 1.56.2 on July 31, 2026, but WordPress.org version data suggested roughly half of the plugin’s 600,000+ installs were still vulnerable when details went public on August 18. No in-the-wild exploitation had been reported at that point.

Our full breakdown covers the MIME-key bypass and the four-question exposure checklist: Forminator vulnerability CVE-2026-15748.

What is the User Profile Builder flaw?

A type confusion bug (CWE-704) in which the plugin casts a failed wp_insert_user() result to an integer before checking whether it is an error. In PHP, casting an object to an integer yields 1 — so a deliberately failed registration logs the attacker in as user ID 1, normally the site owner.

Exploitation needs “Automatically Log In after Registration” enabled and user ID 1 to hold administrator privileges. Cozmoslabs patched it in 3.16.5 on July 16, 2026, two days after the report reached Wordfence. Details: User Profile Builder vulnerability CVE-2026-15826.

What is the trend behind August’s incidents?

Two shifts stand out. First, the window between public disclosure and mass exploitation is now measured in hours, not days — automated bots probe for newly disclosed plugin flaws before most administrators read the advisory. Second, attackers are moving upstream, targeting plugin vendors instead of individual sites.

The BdThemes campaign shares command-and-control infrastructure with earlier compromises involving OptinMonster and Advanced Responsive Video Embedder. That is a pattern, not a coincidence: compromise one vendor and you reach every site that trusts it, without touching a single one of them directly.

The practical consequence is that “keep everything updated” is no longer sufficient advice. Two of this month’s three incidents were invisible to update-based defences — one had no patch, and the other was already patched a month before most owners heard about it.

What should I do on my own site this month?

Work through a fixed triage routine rather than reacting to headlines. The goal is to confirm exposure, patch what has a fix, mitigate what does not, and verify no one already got in. Twenty minutes covers all four on a typical site.

1. List active plugins and check them against this month’s table: wp plugin list --status=active --fields=name,version.
2. Deactivate any BdThemes product until a fixed release ships.
3. Update Forminator to 1.56.2+ and User Profile Builder to 3.16.5+.
4. Audit administrator accounts against the database, not just the dashboard.
5. Search for emer-run.php and for PHP files newer than your last deployment.
6. If anything looks wrong, rotate salts and all admin passwords before investigating further.

Step 4 is the one people get wrong, because malware can hide accounts from the Users screen. Our guide on finding and removing rogue WordPress admin accounts includes the SQL query that bypasses that filtering, and our roundup of the best WordPress security plugins covers which tools alert on new administrator creation.

Frequently asked questions

Which August 2026 WordPress vulnerability is most urgent?

The BdThemes supply-chain attack, because it was actively exploited and has no patch. Deactivating the affected plugins is the only reliable mitigation. The two CVSS 9.8 CVEs are more severe on paper but both have fixes you can apply immediately.

Is a high CVSS score the best guide to patch priority?

No. CVSS measures theoretical severity in isolation. Patch priority should weigh whether exploitation is happening now, whether a fix exists, and whether your specific configuration meets the exploit’s preconditions. August 2026 is a clean example of a medium-rated flaw outranking two critical ones.

How quickly are new WordPress flaws exploited?

Within hours of public disclosure. Automated scanners begin probing for newly disclosed plugin vulnerabilities before most site administrators have seen the advisory, which is why scheduled monthly patching is no longer adequate for widely installed plugins.

Does this roundup list every WordPress CVE from August 2026?

No. It covers the three incidents with the largest install base and clearest owner action. Dozens of lower-severity plugin advisories are published monthly; for exhaustive tracking, monitor the Wordfence Threat Intelligence feed alongside this summary.

Sources

• BleepingComputer — BdThemes plugins supply-chain hack (August 2026)
• SecurityWeek — 300,000 WordPress Sites Exposed Due to Form Plugin Flaw (August 18, 2026)
• Infosecurity Magazine — WordPress Plugin Flaw Exposes 40,000 Sites (August 17, 2026)
• The Hacker News — BdThemes Supply Chain Attack Poisons JSON (August 2026)