Wordfence deployed a new firewall rule last week for a WordPress plugin flaw serious enough to block on sight, and it sits in the connector plugin that agencies use to manage their clients' sites. It appears in the company's weekly WordPress vulnerability report covering July 27 to August 2, 2026.
What's affected
The rule covers WPMU DEV Dashboard in versions 5.0.0 and below. Wordfence labels it an authentication bypass to arbitrary plugin installation, notes in the same line that this amounts to remote code execution, and says it is reached via a forged WDP_AUTH HMAC on the ?wpmudev-hub= endpoint. An HMAC is a cryptographic signature meant to prove a request genuinely came from the vendor's service. What makes it worth attention is the plugin's role rather than the bug class: it is installed precisely on sites that are managed in bulk, so a working request against it reaches a portfolio rather than a single site.
Wordfence has not published exploitation detail, affected-install figures or a CVE identifier for the issue in this report, and it does not yet carry a public write-up. Treat the rule description above as the full extent of what has been disclosed, and watch the plugin changelog for the vendor's own advisory.
Two more rules, details withheld
Wordfence also shipped two rules it will only identify as WAF-RULE-935 and WAF-RULE-937, with the note that the data is redacted while it works with the vendor on a patch. In other words, at least one unfixed flaw is currently being shielded by the firewall while a fix is written.
The week in numbers
The same report counts 224 vulnerabilities added to the Wordfence Intelligence Vulnerability Database for the week, across 177 WordPress plugins and 2 WordPress themes, submitted by 119 vulnerability researchers. Of those, 186 were patched and 38 were unpatched. By severity, Wordfence counted 13 critical, 61 high and 150 medium. Cross-site scripting led the vulnerability types at 72, followed by missing authorization at 47 and SQL injection at 31. The affected plugin list runs to well over a hundred names and includes widely deployed form, booking, e-commerce and Elementor add-on plugins.
What you should do
Update WPMU DEV Dashboard now if you run it, and check the report's plugin list against your own site inventory before assuming you are clear. One detail worth planning around: Wordfence says Premium, Care and Response customers received these rules immediately, while sites running the free version get the same protection after a 30 day delay. For most WordPress owners that gap means patching is the real defence, not the firewall. Where a plugin has no fix available, the practical options are deactivating it or restricting access to the affected endpoint at the web server.
Plugin and core flaws remain the most reliable route into WordPress sites. Earlier this week we covered a WordPress bug that runs code on the server when an administrator clicks a link, and in July a core REST API flaw that let attackers take over sites without logging in.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.