WordPress vulnerability research

Protected vulnerabilities.

Review the attack behind each advisory and the BitFire control—bot protection, WAF, or runtime RASP—that prevents it from becoming a compromise.

Verified-client bot controls Behavior-based WAF Runtime RASP enforcement
Advisory library

How BitFire stops known vulnerabilities

Showing 13–18 of 52 records · Updated October 9, 2026

High
CVE-2026-96039

BA Book Everything

CVSS7.2

BitFire FREE Bot Protection and WAF stop CVE-2026-96039, an unauthenticated stored XSS chain in BA Book Everything, before the payload ever reaches WordPress.

Affected sites
10000
Attack class
Stored Cross-site Scripting
BitFire protectionSecure with BitFire WAF + BitFire Bot Protection
Read technical analysis
Medium
CVE-2026-92799

Bookly

CVSS5.3

BitFire FREE Bot Protection and BitFire PRO RASP stop the unauthenticated CVE-2026-92799 Bookly verification bypass that overwrites customer records.

Affected sites
60000
Attack class
Type Juggling Authorization Bypass
BitFire protectionSecure with BitFire PRO RASP + BitFire Bot Protection
Read technical analysis
High
CVE-2026-92713

Modula Image Gallery

CVSS8.1

BitFire FREE Bot Protection stops the automated REST delivery of CVE-2026-92713, the Modula Image Gallery Author-level arbitrary file deletion flaw.

Affected sites
100000
Attack class
Missing Authorization
BitFire protectionProtected by BitFire Bot Protection
Read technical analysis
Medium
CVE-2026-92212

JetFormBuilder

CVSS6.1

BitFire's FREE WAF blocks the malicious query-string payloads behind the JetFormBuilder CVE-2026-92212 reflected XSS before WordPress processes the request.

Affected sites
80000
Attack class
Reflected Cross-site Scripting
BitFire protectionSecure with BitFire WAF
Read technical analysis
High
CVE-2026-89426

Knit Pay

CVSS8.8

CVE-2026-89426 lets any Knit Pay 9.6.1.0 user become administrator via Gravity Forms. BitFire FREE Bot Protection and PRO RASP stop the chain.

Affected sites
2000
Attack class
Broken Access Control
BitFire protectionSecure with BitFire PRO RASP + BitFire Bot Protection
Read technical analysis
High
CVE-2026-84281

Fancy Product Designer

CVSS7.2

BitFire FREE Bot Protection and WAF stop the unauthenticated AJAX delivery and script payload behind CVE-2026-84281 before Fancy Product Designer stores it.

Affected sites
Not publicly reported
Attack class
Stored Cross-site Scripting
BitFire protectionSecure with BitFire WAF + BitFire Bot Protection
Read technical analysis

Page 3 of 9

Protect your WordPress website

Stop the operation, not only the signature.

BitFire combines bot controls, request inspection, and runtime enforcement so emerging vulnerabilities fail before a CVE-specific rule exists.

Install BitFire free Contact BitFire support
Protect my site free →