Wordfence, the WordPress security company, has launched a dedicated Threat Response Team to respond to active attacks against WordPress sites, a move that could be significant for Nigerian organisations and publishers relying on the platform for public-facing websites and digital services.

The new team, led by senior vulnerability researcher Alex Thomas, is designed to respond to rapidly emerging threats during what Wordfence describes as the critical first 72 hours after an active threat is identified. The team will handle reports involving active exploitation of WordPress plugins or themes, supply-chain compromises and attack campaigns targeting multiple sites.

The development comes at a time when WordPress security has become an increasingly important concern for Nigerian organisations. In August, Nigeria’s Computer Emergency Response Team (ngCERT) warned that a large-scale cybercrime operation known as StopAndProtect had compromised thousands of WordPress websites globally, using some of the sites as infrastructure for malware delivery, command-and-control and storage of stolen data. Nigerian organisations running WordPress sites were specifically urged to take protective action.

The ngCERT warning underscores why faster identification and response to WordPress threats matters in Nigeria, where government agencies, businesses, media organisations, educational institutions and other organisations use websites to deliver public-facing services and information.

The ngCERT warning underscores why faster identification and response to WordPress threats matters in Nigeria, where government agencies, businesses, media organisations, educational institutions and other organisations use websites to deliver public-facing services and information.

Wordfence says reports of active threats can now be sent directly to its Threat Response Team rather than entering a general support queue. The company says the team will assess reports and, where an emerging threat is confirmed, work to put protection in place for Wordfence users while publishing guidance for affected site owners.

The company has distinguished the new response function from its longer-term vulnerability research. Its Threat Intelligence Team will continue handling vulnerability research, vulnerability records and routine disclosure work, while the Threat Response Team will focus on urgent, active threats requiring immediate attention.

WordPress vulnerability research

Thomas, who leads the new Threat Response Team, is a senior vulnerability researcher at Wordfence with OSCP and GPEN certifications. Wordfence’s vulnerability research profile credits him with 76 vulnerability discoveries and ranks him 84th in its all-time researcher ranking.

Thomas has contributed to research into vulnerabilities affecting WordPress plugins and themes, including multiple unauthenticated cross-site scripting vulnerabilities. Wordfence’s research records also show him among researchers who have disclosed vulnerabilities across the WordPress ecosystem.

His work is relevant to the Nigerian market because vulnerabilities in widely deployed WordPress components can affect organisations regardless of where their websites are hosted. A vulnerable plugin, theme or underlying server component can provide attackers with a route into websites that may hold administrative credentials, customer information or other sensitive data.

The threat is not limited to WordPress itself. Recent research from Thomas on two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, illustrates the importance of securing the wider technology stack supporting WordPress websites. The vulnerabilities affect PHP, the programming language on which WordPress primarily runs, and Wordfence says they can allow unauthenticated remote code execution on affected systems. Updating WordPress itself does not install the PHP fixes.

Nigerian website operators and new WordPress threats

The latest development highlights a broader security challenge for Nigerian organisations: protecting a WordPress website requires attention not only to the content management system but also to its plugins, themes, PHP runtime, web server, operating system and other supporting infrastructure.

Wordfence says its security approach is based on defence in depth, combining WordPress-specific threat intelligence, firewall protection, malware detection and remediation. The company says its network protects more than five million WordPress websites and that attack data gathered across its network informs its security rules and malware signatures.

Wordfence also operates a vulnerability database covering WordPress core, plugins and themes and is authorised to assign CVE identifiers to qualifying WordPress vulnerabilities. Its vulnerability disclosure process allows researchers to report security flaws for review and possible CVE assignment.

For Nigerian website operators, the significance of the new Threat Response Team therefore extends beyond Wordfence users. It reflects the growing importance of rapid threat intelligence, responsible vulnerability disclosure and coordinated response as attackers increasingly target the software supply chain and publicly accessible websites.

The launch also provides another channel through which active threats affecting the WordPress ecosystem can be escalated quickly. Wordfence says site owners who identify an actively exploited plugin or theme, a supply-chain compromise or a campaign targeting multiple WordPress sites can report it directly to the Threat Response Team.

With ngCERT already warning Nigerian organisations about the abuse of compromised WordPress websites, the ability to identify and escalate active attacks quickly could become an increasingly important part of the country’s broader website security response.