Cybersecurity Policy Report, WordPress Vulnerabilities Prompt Warning in Netherlands, (Aug 31, 2026)
By Tony Foley
Following the discovery of vulnerabilities in the WordPress content management system that have led to a number of data breaches, the Dutch data protection authority, Autoriteit Persoonsgegevens (AP), has released advice for users on managing the risks presented by the software.
The vulnerabilities in WordPress are being actively exploited, and the risks of the resulting data breaches have not always been properly assessed by affected organizations, the AP said Thursday in a news release.
The vulnerability allows threat actors to take over the WordPress system, giving it unrestricted access to everything in it, including information on the users and administrators of an organization’s site, like forum posts, purchases, consultations, quotations, or completed web forms. Noting that an update was available to address the issue, the AP said many users hadn’t yet installed it.
AP recommended the following actions organizations should take:
Check the version of WordPress being used and update it to the latest version if necessary;
Check systems for vulnerabilities and investigate potential exploitations with assistance from hosting or IT service providers; and
If evidence of abuse is found, activate the organization’s incident response plan.
The guidance outlined organizational responsibilities regarding reporting a data breach to the AP and informing people whose data may have been compromised if the organization’s risk assessment triggers a notification obligation.
News: InternationalLegislation DataSecurity