Blog

What the engine found

Disclosures from pointing it at code nobody had audited, and what the pattern behind each one means for anything else built the same way.

9.8

Critical

20 August 2026

The password you never needed

A convenience feature in a plugin that had nothing to do with authentication became a full account takeover. Public as CVE-2026-77264, scored 9.8 of 10 by Wordfence.

Read it →CVE-2026-77264 · CWE-640

See what a scan turns up

Nominate a target. The first scan costs nothing, and we’ll walk you through it.

Get a free scan See the pricing