It isn’t just obscure plugins.

WordPress core

WordPress 7.1.4: twelve fixes, one in the updater

WordPress's own update process had a weakness that could let an attacker run code on the server during the window while a site is updating. The same release fixed eleven more flaws, most of them ways for a signed-in user to plant scripts in pages, plus two leaks of unpublished content.

What to check · Confirm WordPress is on 7.1.4 or the patched release of your branch. Automatic background updates usually handle this, so check that yours actually ran.

On THINQ Site · A THINQ Site is never updated in place on the live server. Each release is built and tested as a whole, then swapped in, so there is no half-updated window to attack.

PHP / server

PHP2Shell — PHP itself

Two flaws in PHP, the language WordPress runs on, could let an attacker take over the web server with a single request and no login, whatever plugins or theme the site uses. Attempts started before the fix shipped, and on October 26 CISA confirmed real attacks after a honeypot recorded one succeeding.

What to check · Ask your host whether PHP is on a fixed version (or a patched vendor build if you're on 8.1 or older); updating WordPress does not fix this.

On THINQ Site · THINQ Site doesn’t run PHP at all, so there’s nothing here for this to hit and no host patch to wait on. We left PHP out on purpose: it’s the layer every WordPress site depends on and no owner controls.

Vendor breach

UpdraftPlus: stolen UpdraftCentral keys

4M+ active installs; TeamUpdraft says its plugins run on 5M+ sites

Attackers broke into TeamUpdraft's own website and stole the keys that let UpdraftCentral manage customers' sites remotely. They used those keys to install backdoor plugins and hidden admin accounts on connected sites, and the backdoors get around two-factor login.

What to check · Update UpdraftPlus, delete the UpdraftCentral key under Settings > UpdraftPlus > Advanced Tools, and look for unknown plugins (including must-use plugins) and admin accounts.

On THINQ Site · No plugin company holds a key to a THINQ Site. Remote editing through THINQ Connect signs in through the site itself, needs an admin’s approval, can change content but never install code, and can be revoked at any time.

Vendor breach

Rank Math SEO PRO: poisoned download

Paid PRO edition only; the free WordPress.org plugin is not affected

For about eleven hours, some copies of Rank Math SEO PRO 3.0.123 came with malware. Sites that activated a tainted copy got a backdoor that rebuilds itself on page visits, hidden admin accounts and a fake WordPress core file, and their passwords and API keys should be treated as exposed.

What to check · If you use Rank Math PRO, check whether you downloaded or updated it between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026. If you did and activated it, treat the site as hacked: delete the rank-math-pro folder, look for wp-includes/class-wp-cache-util.php and unknown admins, and change every password and key.

On THINQ Site · There are no add-ons to buy or download for a THINQ Site. Every feature ships from our own code, through a build that is tested against each site before it goes out.

Plugin

Backuply

600,000+

Anyone with the lowest kind of account on a site could hide database commands in their profile bio. The next time an admin restored a backup, those commands ran and opened the site to new admin sign-ups.

What to check · Make sure Backuply is on 1.5.9 or later. Before restoring any older backup, check user bios for anything that looks like code.

On THINQ Site · THINQ Site has no database to inject into. Content is stored as plain files that are checked against a strict schema, and a restore needs a signed-in admin.

Attack campaign

CyberXero: AI-run attacks on WordPress sites

Researchers described a criminal group using an AI coding agent, with dozens of sub-agents, to find and break into websites automatically. In one run it scanned 4,708 sites, got into 429 WordPress admin panels and planted 32 web shells within 61 seconds. Its main way in is wp2shell, a WordPress hole fixed in July, so it finds sites that stopped updating.

What to check · Make sure WordPress is current, then look under Users for an administrator named wp2_ plus eight characters and under Plugins for a folder starting with wp2shell_.

On THINQ Site · Its main way in, wp2shell, needs WordPress’s plugin installer and database. THINQ Site has neither, so automated scans for it come up empty.

Plugin

Elementor: one-click admin takeover

10M+ total; the affected versions were on up to 2M sites

If a logged-in administrator clicked a booby-trapped link (in an email, chat or comment), the attacker could quietly get their own administrator account on the site. Only Elementor 4.3.0 and 4.3.1 were affected.

What to check · Update Elementor to 4.3.2 or later and check the user list for administrators you didn't create.

On THINQ Site · The THINQ Site admin only accepts a change that comes from the admin screen itself, so a link clicked in an email or chat can’t act on an administrator’s behalf. That check runs on every admin request.

WordPress core

WordPress core: page-template flaw

A bug in how WordPress finds page templates could let an attacker run code on the server without logging in, but only on some setups (it depends on the theme's folder names and the server's PHP setup). Attackers started trying it within hours, using the published fix as a guide.

What to check · Confirm WordPress is on 7.1.2 or later (or the patched version of your branch) and look for unknown PHP files in /tmp or the site folders.

On THINQ Site · THINQ Site draws every page from a fixed list of layouts built into the platform, never from a file path made out of what a visitor sends, and every page name must pass a strict pattern.

Hosting

cPanel & WHM and WP Toolkit

On shared cPanel hosting, anyone with an ordinary hosting account could take full control of the whole server, which also puts every other site on it at risk. A related bug in WP Toolkit, cPanel's WordPress manager, let one account change other accounts' databases.

What to check · If you're on cPanel hosting, ask your host whether cPanel and WP Toolkit (a separate update) are patched.

On THINQ Site · No cPanel and no shared server: each THINQ Site runs in its own container, deployed from code. One account can’t reach another site’s files or data.

Plugin

The Events Calendar

600,000+; 200,000+ potentially exposed

Two flaws let an outsider take over the site through a comment on a public event page. Sites are at risk when comments are switched on for events.

What to check · Update The Events Calendar to 6.17.4.1 or later, or turn off comments on events until you can.

On THINQ Site · THINQ Site has no public comments to abuse, and features like events are part of the platform, tested before they ship, rather than an add-on from another company.

Vendor breach

Admin Menu Editor Pro: developer’s site breached

Pro version: at least 1,500 sites got the bad update; the free version does not appear to be affected

Attackers broke into the developer's website and published two poisoned updates of the paid Pro plugin (2.35 and 2.36) that installed a hidden backdoor and a secret user account. At least 230 customers installed them on about 1,500 sites.

What to check · If you run Admin Menu Editor Pro 2.35 or 2.36, remove it, look for hidden users and stray PHP files, or restore a backup from before September 14.

On THINQ Site · Nothing on a THINQ Site updates itself from a vendor. Platform updates come only from our own code, and each one is built and tested against every site before it ships.

Plugin

GiveWP

100,000+

A maximum-severity flaw in GiveWP's donation processing let an attacker run commands on the server. Sources disagree on whether an attacker needs an account, but the plugin itself can create one even when site registration is off.

What to check · Update GiveWP to 4.16.7.2 or later, especially if the site still has older (legacy) donation forms.

On THINQ Site · There’s no plugin layer and no PHP to run commands through. Every THINQ Site feature is part of the platform and tested before it reaches a site.

Theme

Avada theme and Fusion Builder

more than 1M copies sold; no active install count published

A flaw in the best-selling Avada theme and its builder plugin let someone write and run their own code on the site without logging in, which means full takeover. The researchers held back the details to give owners time to update.

What to check · Update both the Avada theme and the Avada/Fusion Builder plugin, since they ship separately.

On THINQ Site · Designs on THINQ Site are built into the platform. There’s no third-party theme or page builder running its own code on the server.

Plugin

All-in-One WP Migration

5M+; about 3.25M still vulnerable as of Sept 2

An outsider could plant hidden code through a trackback that activates the next time an administrator exports and imports the site, and that can lead to a full takeover. It needs an admin to run a restore, but restoring is what this plugin is for.

What to check · Update All-in-One WP Migration to 7.110 or later before your next export or import.

On THINQ Site · Backup and restore are part of the platform, admin-only, and a restore refuses any file that tries to land outside the site’s own content folders. There are no trackbacks to plant code through.

Plugin

Elementor Pro: form file uploads

6M+

Elementor Pro's form widget could be tricked into accepting a program file through a file-upload field, which let attackers run their own code and take over the site without logging in. Attacks started the day the fix came out, with about 190,000 attempts blocked in the first few days.

What to check · Update Elementor Pro to 4.2.2 or later and check wp-content/uploads/elementor/forms/ for any .php file, which is a strong sign of a break-in.

On THINQ Site · A file uploaded through a THINQ Site form is checked against a short list of allowed types, saved under a random name and never run as code. There’s no PHP to run it anyway.

Attack campaign

StopAndProtect campaign

Criminals took over close to 2,000 WordPress sites, many running outdated WordPress and plugins, and used them to show visitors a fake 'prove you're human' check that tricked Windows users into installing data-stealing and ransomware tools. The hacked sites also stored the stolen data.

What to check · Visit your site as a logged-out visitor and look for any unexpected CAPTCHA or 'verify' pop-up, plus unknown plugins or must-use plugins.

On THINQ Site · Campaigns like this one are built on sites already broken into through outdated WordPress and plugins. We built THINQ Site without those layers rather than asking owners to keep patching them.

Plugin

Forminator

600,000+

Anyone could upload a program file through a public form and, on some setups, run it, which hands over the site. The site needs a form with both a file-upload field and a dropdown field to be at risk.

What to check · Update Forminator to 1.56.2 or later, especially if any form has a file-upload field.

On THINQ Site · A file someone uploads through a THINQ Site form can’t become a program on the server: it’s stored as a plain file and only ever handed back as a file.

WordPress core

wp2shell — WordPress core

Two bugs in WordPress itself could be chained together to take over a site without logging in: the attacker creates an admin account, then uploads a malicious plugin. Within days attackers were installing backdoors and rogue admin accounts on sites that hadn't updated.

What to check · Check that the site is really on a fixed version (forced updates miss sites with auto-updates turned off) and look for unfamiliar admins, plugins or PHP files in wp-content/cache.

On THINQ Site · This attack creates an admin through the database, then installs a plugin. THINQ Site has no database (content is files) and no plugin installer, so the chain has no first step.

Plugin

UpdraftPlus: login bypass

3M+

A flaw in UpdraftPlus's remote-management channel let an attacker get administrator access without logging in, on sites that had an active Migrator or UpdraftCentral key. Some hosts pushed the fix to their customers themselves.

What to check · Confirm UpdraftPlus is on 1.26.5 or later, which you need anyway for the October fix below.

On THINQ Site · THINQ Site’s one remote channel, THINQ Connect, signs in through the site itself, needs an admin’s approval and issues keys that only work on the site that issued them.

Plugin

Kirki

500,000+; about 150,000 on vulnerable versions

A bug in the plugin's password-reset feature let anyone request a reset link for any account, including an administrator, and have it sent to their own email address, then take over that account. Attackers started using it right after it went public.

What to check · Make sure Kirki is on 6.0.7 or later and look for administrator accounts or password changes you don't recognise.

On THINQ Site · THINQ Site never emails a password-reset link. Recovery needs the account’s authenticator app, so there’s no reset link to hijack.

Plugin

Avada Builder

about 1,000,000

Two flaws in the builder that ships with the Avada theme: any logged-in subscriber could read private server files such as wp-config.php (which holds the database password), and on sites where WooCommerce had been installed and then switched off, an outsider could pull data like password hashes from the database.

What to check · If your site uses the Avada theme, update the Avada Builder plugin to 3.15.3 or later.

On THINQ Site · There’s no wp-config.php and no database password to read. The site’s keys live in the host’s settings, outside anything a page can display.

Hosting

cPanel & WHM: login bypass

about 1.5 million exposed instances; 70M+ domains run on cPanel

The most common hosting control panel had a bug that let an outsider log in as the server's top administrator without a password, giving control of every site, database and email account on that server. It was attacked widely; Shadowserver estimated more than 44,000 servers likely compromised.

What to check · Ask your host to confirm their cPanel/WHM servers were patched for CVE-2026-41940, and change your cPanel password afterwards.

On THINQ Site · THINQ Site doesn’t use cPanel or any hosting control panel. Sites are deployed from code, so there’s no panel login to bypass.

Plugin

Breeze Cache (Cloudways)

400,000+

Cloudways' caching plugin let anyone upload a file and take over the site without logging in, but only if the non-default 'Host Files Locally - Gravatars' option was switched on. Attacks started right after disclosure.

What to check · Update Breeze to 2.4.5 or later, and leave 'Host Files Locally - Gravatars' off unless you need it.

On THINQ Site · Caching is built into THINQ Site itself, not added by a plugin, and nothing in it accepts files from visitors.

Plugin

Ninja Forms File Uploads add-on

about 90,000 customers for the add-on; Ninja Forms itself 600,000+

The file-upload add-on for Ninja Forms let anyone upload a program to the site and take it over without logging in. Wordfence reported thousands of attack attempts a day after details went public.

What to check · If you use Ninja Forms with the File Uploads add-on, make sure the add-on is on 3.3.27 or later.

On THINQ Site · THINQ Site form uploads are limited to a short list of file types, renamed at random and stored as plain files the server never runs.

Vendor breach

EssentialPlugin suite: backdoored by its new owner

hundreds of thousands combined across 20-30+ plugins

A new owner bought this plugin company and quietly hid a backdoor in all of its plugins in 2025; it switched on in April 2026 and injected hidden spam and redirects that only Google could see. WordPress.org shut the plugins down and pushed an update that disables the backdoor, but it does not clean up files the malware already changed.

What to check · Look for any EssentialPlugin / WP Online Support plugins (sliders, popups, galleries, countdowns), replace them, and check wp-config.php and for a stray wp-comments-posts.php file.

On THINQ Site · There’s no plugin marketplace whose ownership can quietly change hands. Every THINQ Site feature is our own code, and every change is built and tested before it reaches a site.

Vendor breach

Smart Slider 3 Pro: poisoned update

800,000+ across free and Pro editions; free WordPress.org version not affected

Attackers broke into Nextend's update server and shipped a poisoned Pro update (3.5.1.35) for about six hours. Sites that installed it got a hidden admin account and several backdoors that let the attacker run anything on the server.

What to check · If you use Smart Slider 3 Pro, confirm you never ran 3.5.1.35; if you did, treat the site as hacked (look for 'wpsvc_' admin users and reset all passwords).

On THINQ Site · No vendor can push an update to a THINQ Site. Updates come from our own code through a build that’s tested against each site, and a failed check stops it from shipping.

Plugin

Everest Forms Pro

Everest Forms: 100,000+; Pro add-on count not published

A flaw in the Pro add-on's calculation feature let anyone run code on the site just by submitting a form, with no login. From April 2026 attackers used it to create rogue admin accounts (Wordfence blocked over 29,000 attempts).

What to check · Update Everest Forms Pro to 1.9.13 or later and look for unknown admin users (one reported name: 'diksimarina').

On THINQ Site · THINQ Site forms store what people type as data. Nothing in a submission is ever run as code.

Plugin

Gravity SMTP (Gravity Forms)

about 100,000

Anyone could request a 'system report' from the plugin without logging in, exposing the email service passwords, API keys and tokens it stores, plus details about the site and server. Attackers began harvesting it at scale in May and June 2026; Wordfence blocked more than 17 million attempts.

What to check · Update Gravity SMTP to 2.1.5 or later and, if you ran an older version, rotate the email-service API keys and passwords it held.

On THINQ Site · The keys THINQ Site uses for email and spam protection can be saved but never read back, even by an admin, and no public page reports on the site’s setup.

Plugin

Ally by Elementor

400,000+

An outsider could pull information out of the site's database without logging in. It only worked on sites where Ally was connected to an Elementor account with its Remediation module switched on.

What to check · If you use Elementor's Ally accessibility plugin, confirm it is on 4.1.0 or later.

On THINQ Site · There’s no database to pull information out of. THINQ Site stores content as files and adds no plugins that could open one up.

Attack campaign

Fake CAPTCHA campaign on hacked WordPress sites

Attackers broke into more than 250 legitimate WordPress sites in at least 12 countries and showed visitors a fake 'verify you are human' box that tricked them into running a command that installs password-stealing malware. The injected code hid itself from logged-in site owners, and the way in was not confirmed (likely an outdated plugin, stolen passwords or password guessing).

What to check · Visit your site logged out or in a private window to look for unexpected 'verify you are human' pop-ups, and turn on two-factor login for every admin.

On THINQ Site · These attackers needed hacked sites to host their trap. THINQ Site has no plugins, no PHP and no database, and it only loads scripts from a short, fixed list of places.

Plugin

W3 Total Cache

900,000+

A bug in the plugin's 'dynamic fragment caching' feature could let an outsider run their own code on the site by posting a crafted comment, without logging in. Public exploit code was reported in late May 2026.

What to check · Update W3 Total Cache to the latest release (2.9.2 or later).

On THINQ Site · Caching is part of the platform and there are no public comments, so there’s no way to post code into the cache.

Plugin

WPvivid Backup & Migration

900,000+

A flaw in this popular backup plugin let an outsider upload a file and take over the site without logging in. Only sites that had turned on the non-default 'receive a backup from another site' option were exposed, for the 24 hours that the transfer key stays valid.

What to check · Make sure WPvivid is on 0.9.124 or later, and switch off 'receive backup from another site' when you are not mid-migration.

On THINQ Site · Restoring a backup on THINQ Site needs a signed-in admin, and a restore refuses any file that tries to land outside the site’s own content folders.