In March 2026, security researchers submitted findings to the Wordfence Bug Bounty Program that should make any WordPress site owner stop and think. Two critical vulnerabilities were discovered in Avada Builder — a page builder plugin actively running on an estimated one million WordPress websites: Patches were eventually released: the first on April 13, 2026, …