Quick answer: Two critical plugin vulnerabilities dominated August 2026: Everest Forms (CVE-2026-19598, 100,000+ sites, unauthenticated file upload leading to full site takeover — update to 3.0.9.5 or later) and User Profile Builder (CVE-2026-15826, CVSS 9.8, 40,000 sites, unauthenticated admin account access — update to 3.16.5 or later). If you run either plugin, update now and check for rogue admin users.
This is the monthly roundup: the disclosed WordPress vulnerabilities that actually matter for business sites, in plain English, with the 60-second self-check at the end. Not every CVE makes this list — the hundreds of minor disclosures each month mostly affect obscure plugins; these are the ones with real installed bases and real exploit paths.
Everest Forms — unauthenticated file upload, 100,000+ sites
CVE-2026-19598 · disclosed August 24, 2026 · fixed in 3.0.9.5
Everest Forms, a popular form-builder plugin, shipped a flaw in its file-upload handling that lets an attacker with no login upload arbitrary files — including PHP scripts the server will execute. That's the worst category of WordPress vulnerability: unauthenticated remote code execution, reachable by anyone who can find your contact form.
If you run it: update to 3.0.9.5 or later immediately. Then assume the window mattered — roughly half of high-impact flaws are exploited within 24 hours of disclosure (Patchstack, 2026) — and check your uploads directory for PHP files that shouldn't be there, plus your admin user list for accounts you didn't create.
User Profile Builder — admin takeover, 40,000 sites
CVE-2026-15826 · CVSS 9.8 · disclosed August 17, 2026 · fixed in 3.16.5
A type-confusion error in the registration and auto-login flow of User Profile Builder lets unauthenticated attackers access the site's administrator account — from there: content changes, new admin accounts, malicious code, and access to whatever data the site holds. The fix (3.16.5) actually shipped on July 16; the public disclosure a month later is when automated exploitation typically ramps up.
If you run it: update to 3.16.5 or later, audit the admin user list, and rotate admin passwords if your version was exposed in between.
The 60-second self-check (do this monthly)
- Plugins → Installed Plugins: is either plugin above on the list? Update first, read later.
- Count the plugins marked "update available" — each is a disclosed gap on your site right now.
- Users → Administrators: any account you don't recognize? That's an incident, not a curiosity — here's what to do in the next hour.
- Note the plugins you don't remember why you installed. Every one is attack surface with no job.
The pattern worth noticing
Both of this month's headline flaws share the signature of the modern WordPress incident: popular plugin, unauthenticated exploit path, six-figure installed base, patch racing exploit scanners. That's not an unlucky month — 2025 produced 11,334 disclosures, ~91% in plugins, and the structural picture hasn't changed in 2026. Updating fast is the game while you're on WordPress; not having to play is the alternative.
Sources: Cybersecurity News — Everest Forms flaw, Infosecurity Magazine — User Profile Builder flaw. Details as reported at the time of writing; always verify current patch versions in the official plugin changelog.