Security Alert: WordPress Security Update - August 2026

11 August 2026

Wordfence has released security updates for WordPress Core, plugins, and themes to address multiple vulnerabilities, including the High‑severity CVE‑2026‑64638 (XSS2Shell) in WordPress Core that allows attacker‑controlled JavaScript to run in a site’s origin without requiring login, potentially leading to full compromise.

Affected Systems:

The affected systems and versions include, but are not limited to:

WordPress Core: versions prior to 7.0.2

WordPress Plugins:

Element Pack Addons for Elementor: versions prior to 8.3.15
Appointment Booking for LatePoint: versions prior to 5.3.2

WordPress Theme :

Betheme Theme: versions prior to 28.1.3

Security Risks

Successful exploitation of these vulnerabilities could allow authenticated attackers to execute arbitrary code, escalate privileges, or inject malicious scripts, leading to compromise of WordPress sites, exposure of sensitive data, and disruption of critical operations.

Recommended Actions

The National Cyber Security Authority (NCSA) recommends users and system administrators to:

1. Update as soon as possible to the latest supported versions of all affected WordPress components to address known vulnerabilities and reduce the risk of exploitation.

The WordPress components versions available for upgrade include, but are not limited to

WordPress Core: Upgrade to version 7.0.3 or above

Wordpress Plugins:

Element Pack Addons for Elementor: Upgrade to version 8.3.16 or above
Appointment Booking for LatePoint: : Upgrade to version 5.4.0 or above

Wordpress Theme:

• Betheme Theme: Upgrade to version 28.1.4 or above

2. Before updating or patching, please ensure that you have the latest backup that can easily be restored.

For further information and support, please contact the National Cyber Security Authority (NCSA) by email to rwcsirt@ncsa.gov.rw or call us on 9009.

References