I use a child theme. Does updating the parent overwrite my changes?

No — that is what the child theme is for. Customisations in the child survive a parent update. What breaks is the other arrangement: edits made directly to the parent theme's files are lost on update, which is itself a reason to move them into a child theme now.

The theme was purchased outside WordPress.org. Why does Wordfence still flag it?

Premium themes push update data through their own channels, and WordPress surfaces it the same way. If Wordfence reports an update you cannot see, check the theme's licence status — expired licences commonly block updates while the vendor keeps announcing them.

An unused theme is flagged. Does it matter if it is not active?

Somewhat. An inactive theme's code is still on disk and some vulnerability classes are reachable without activation. The clean answer is to delete every theme except the active one and its parent — an update you never have to apply is the cheapest kind.

Glossary · Vulnerability

A theme needs an upgrade

Wordfence type: wfThemeUpgrade
Category: Vulnerability
Severity: Usually Medium

The active or an installed theme is behind its current release.

Written by G. Schad, Cybersecurity Specialist Published 2026-07-31 · Updated 2026-08-22

The alert usually reads

The Theme "Astra" needs an upgrade (4.6.0 -> 4.6.4).

What Wordfence found

A newer version of a theme installed on the site is available. As with plugins, this is drawn from WordPress's own update data.

Why it matters

Themes get less attention than plugins and are often more neglected, yet a theme can contain just as much executable code. Unused themes are also a common hiding place for injected files, so the inventory itself matters.

How to fix it

1Update the theme. If it is a parent theme that has been edited directly, move those edits into a child theme first — otherwise the update will destroy them.
2Delete themes that are not in use. A site needs its active theme and, at most, one default fallback.
3Re-scan to confirm the finding clears.

Common questions

I use a child theme. Does updating the parent overwrite my changes?: No — that is what the child theme is for. Customisations in the child survive a parent update. What breaks is the other arrangement: edits made directly to the parent theme's files are lost on update, which is itself a reason to move them into a child theme now.
The theme was purchased outside WordPress.org. Why does Wordfence still flag it?: Premium themes push update data through their own channels, and WordPress surfaces it the same way. If Wordfence reports an update you cannot see, check the theme's licence status — expired licences commonly block updates while the vendor keeps announcing them.
An unused theme is flagged. Does it matter if it is not active?: Somewhat. An inactive theme's code is still on disk and some vulnerability classes are reachable without activation. The clean answer is to delete every theme except the active one and its parent — an update you never have to apply is the cheapest kind.

How WPSecureOps treats it

The connector reports this as wfThemeUpgrade. WPSecureOps files it under Vulnerability and bands it by the numeric severity Wordfence assigns, so findings of this kind from every site you manage arrive in one queue rather than one email per site. Titles and descriptions are stripped of HTML and the site's absolute path is replaced before anything leaves the server.

Primary references

Product behaviour and remediation guidance were checked against these primary sources.