It isn’t just obscure plugins.

PHP / server

PHP2Shell — PHP itself

Two flaws in PHP, the language WordPress runs on, could let an attacker take over the web server with a single request and no login, whatever plugins or theme the site uses. Attack attempts were seen before and on the day of release, and a public attack tool exists.

What to check · Ask your host whether PHP is on a fixed version (or a patched vendor build if you're on 8.1 or older); updating WordPress does not fix this.

Vendor breach

UpdraftPlus: stolen UpdraftCentral keys

4M+ active installs; TeamUpdraft says its plugins run on 5M+ sites

Attackers broke into TeamUpdraft's own website and stole the keys that let UpdraftCentral manage customers' sites remotely. They used those keys to install backdoor plugins and hidden admin accounts on connected sites, and the backdoors get around two-factor login.

What to check · Update UpdraftPlus, delete the UpdraftCentral key under Settings > UpdraftPlus > Advanced Tools, and look for unknown plugins (including must-use plugins) and admin accounts.

Attack campaign

CyberXero: AI-run attacks on WordPress sites

Researchers described a criminal group using an AI coding agent, with dozens of sub-agents, to find and break into websites automatically. In one run it scanned 4,708 sites, got into 429 WordPress admin panels and planted 32 web shells within 61 seconds. Its main way in is wp2shell, a WordPress hole fixed in July, so it finds sites that stopped updating.

What to check · Make sure WordPress is current, then look under Users for an administrator named wp2_ plus eight characters and under Plugins for a folder starting with wp2shell_.

Plugin

Elementor: one-click admin takeover

10M+ total; the affected versions were on up to 2M sites

If a logged-in administrator clicked a booby-trapped link (in an email, chat or comment), the attacker could quietly get their own administrator account on the site. Only Elementor 4.3.0 and 4.3.1 were affected.

What to check · Update Elementor to 4.3.2 or later and check the user list for administrators you didn't create.

WordPress core

WordPress core: page-template flaw

A bug in how WordPress finds page templates could let an attacker run code on the server without logging in, but only on some setups (it depends on the theme's folder names and the server's PHP setup). Attackers started trying it within hours, using the published fix as a guide.

What to check · Confirm WordPress is on 7.1.2 or later (or the patched version of your branch) and look for unknown PHP files in /tmp or the site folders.

Hosting

cPanel & WHM and WP Toolkit

On shared cPanel hosting, anyone with an ordinary hosting account could take full control of the whole server, which also puts every other site on it at risk. A related bug in WP Toolkit, cPanel's WordPress manager, let one account change other accounts' databases.

What to check · If you're on cPanel hosting, ask your host whether cPanel and WP Toolkit (a separate update) are patched.

Plugin

The Events Calendar

600,000+; 200,000+ potentially exposed

Two flaws let an outsider take over the site through a comment on a public event page. Sites are at risk when comments are switched on for events.

What to check · Update The Events Calendar to 6.17.4.1 or later, or turn off comments on events until you can.

Vendor breach

Admin Menu Editor Pro: developer’s site breached

Pro version: at least 1,500 sites got the bad update; the free version does not appear to be affected

Attackers broke into the developer's website and published two poisoned updates of the paid Pro plugin (2.35 and 2.36) that installed a hidden backdoor and a secret user account. At least 230 customers installed them on about 1,500 sites.

What to check · If you run Admin Menu Editor Pro 2.35 or 2.36, remove it, look for hidden users and stray PHP files, or restore a backup from before September 14.

Plugin

GiveWP

100,000+

A maximum-severity flaw in GiveWP's donation processing let an attacker run commands on the server. Sources disagree on whether an attacker needs an account, but the plugin itself can create one even when site registration is off.

What to check · Update GiveWP to 4.16.7.2 or later, especially if the site still has older (legacy) donation forms.

Theme

Avada theme and Fusion Builder

more than 1M copies sold; no active install count published

A flaw in the best-selling Avada theme and its builder plugin let someone write and run their own code on the site without logging in, which means full takeover. The researchers held back the details to give owners time to update.

What to check · Update both the Avada theme and the Avada/Fusion Builder plugin, since they ship separately.

Plugin

All-in-One WP Migration

5M+; about 3.25M still vulnerable as of Sept 2

An outsider could plant hidden code through a trackback that activates the next time an administrator exports and imports the site, and that can lead to a full takeover. It needs an admin to run a restore, but restoring is what this plugin is for.

What to check · Update All-in-One WP Migration to 7.110 or later before your next export or import.

Plugin

Elementor Pro: form file uploads

6M+

Elementor Pro's form widget could be tricked into accepting a program file through a file-upload field, which let attackers run their own code and take over the site without logging in. Attacks started the day the fix came out, with about 190,000 attempts blocked in the first few days.

What to check · Update Elementor Pro to 4.2.2 or later and check wp-content/uploads/elementor/forms/ for any .php file, which is a strong sign of a break-in.

Attack campaign

StopAndProtect campaign

Criminals took over close to 2,000 WordPress sites, many running outdated WordPress and plugins, and used them to show visitors a fake 'prove you're human' check that tricked Windows users into installing data-stealing and ransomware tools. The hacked sites also stored the stolen data.

What to check · Visit your site as a logged-out visitor and look for any unexpected CAPTCHA or 'verify' pop-up, plus unknown plugins or must-use plugins.

Plugin

Forminator

600,000+

Anyone could upload a program file through a public form and, on some setups, run it, which hands over the site. The site needs a form with both a file-upload field and a dropdown field to be at risk.

What to check · Update Forminator to 1.56.2 or later, especially if any form has a file-upload field.

WordPress core

wp2shell — WordPress core

Two bugs in WordPress itself could be chained together to take over a site without logging in: the attacker creates an admin account, then uploads a malicious plugin. Within days attackers were installing backdoors and rogue admin accounts on sites that hadn't updated.

What to check · Check that the site is really on a fixed version (forced updates miss sites with auto-updates turned off) and look for unfamiliar admins, plugins or PHP files in wp-content/cache.

Plugin

UpdraftPlus: login bypass

3M+

A flaw in UpdraftPlus's remote-management channel let an attacker get administrator access without logging in, on sites that had an active Migrator or UpdraftCentral key. Some hosts pushed the fix to their customers themselves.

What to check · Confirm UpdraftPlus is on 1.26.5 or later, which you need anyway for the October fix below.

Plugin

Kirki

500,000+; about 150,000 on vulnerable versions

A bug in the plugin's password-reset feature let anyone request a reset link for any account, including an administrator, and have it sent to their own email address, then take over that account. Attackers started using it right after it went public.

What to check · Make sure Kirki is on 6.0.7 or later and look for administrator accounts or password changes you don't recognise.

Plugin

Avada Builder

about 1,000,000

Two flaws in the builder that ships with the Avada theme: any logged-in subscriber could read private server files such as wp-config.php (which holds the database password), and on sites where WooCommerce had been installed and then switched off, an outsider could pull data like password hashes from the database.

What to check · If your site uses the Avada theme, update the Avada Builder plugin to 3.15.3 or later.

Hosting

cPanel & WHM: login bypass

about 1.5 million exposed instances; 70M+ domains run on cPanel

The most common hosting control panel had a bug that let an outsider log in as the server's top administrator without a password, giving control of every site, database and email account on that server. It was attacked widely; Shadowserver estimated more than 44,000 servers likely compromised.

What to check · Ask your host to confirm their cPanel/WHM servers were patched for CVE-2026-41940, and change your cPanel password afterwards.

Plugin

Breeze Cache (Cloudways)

400,000+

Cloudways' caching plugin let anyone upload a file and take over the site without logging in, but only if the non-default 'Host Files Locally - Gravatars' option was switched on. Attacks started right after disclosure.

What to check · Update Breeze to 2.4.5 or later, and leave 'Host Files Locally - Gravatars' off unless you need it.

Plugin

Ninja Forms File Uploads add-on

about 90,000 customers for the add-on; Ninja Forms itself 600,000+

The file-upload add-on for Ninja Forms let anyone upload a program to the site and take it over without logging in. Wordfence reported thousands of attack attempts a day after details went public.

What to check · If you use Ninja Forms with the File Uploads add-on, make sure the add-on is on 3.3.27 or later.

Vendor breach

EssentialPlugin suite: backdoored by its new owner

hundreds of thousands combined across 20-30+ plugins

A new owner bought this plugin company and quietly hid a backdoor in all of its plugins in 2025; it switched on in April 2026 and injected hidden spam and redirects that only Google could see. WordPress.org shut the plugins down and pushed an update that disables the backdoor, but it does not clean up files the malware already changed.

What to check · Look for any EssentialPlugin / WP Online Support plugins (sliders, popups, galleries, countdowns), replace them, and check wp-config.php and for a stray wp-comments-posts.php file.

Vendor breach

Smart Slider 3 Pro: poisoned update

800,000+ across free and Pro editions; free WordPress.org version not affected

Attackers broke into Nextend's update server and shipped a poisoned Pro update (3.5.1.35) for about six hours. Sites that installed it got a hidden admin account and several backdoors that let the attacker run anything on the server.

What to check · If you use Smart Slider 3 Pro, confirm you never ran 3.5.1.35; if you did, treat the site as hacked (look for 'wpsvc_' admin users and reset all passwords).

Plugin

Everest Forms Pro

Everest Forms: 100,000+; Pro add-on count not published

A flaw in the Pro add-on's calculation feature let anyone run code on the site just by submitting a form, with no login. From April 2026 attackers used it to create rogue admin accounts (Wordfence blocked over 29,000 attempts).

What to check · Update Everest Forms Pro to 1.9.13 or later and look for unknown admin users (one reported name: 'diksimarina').

Plugin

Gravity SMTP (Gravity Forms)

about 100,000

Anyone could request a 'system report' from the plugin without logging in, exposing the email service passwords, API keys and tokens it stores, plus details about the site and server. Attackers began harvesting it at scale in May and June 2026; Wordfence blocked more than 17 million attempts.

What to check · Update Gravity SMTP to 2.1.5 or later and, if you ran an older version, rotate the email-service API keys and passwords it held.

Plugin

Ally by Elementor

400,000+

An outsider could pull information out of the site's database without logging in. It only worked on sites where Ally was connected to an Elementor account with its Remediation module switched on.

What to check · If you use Elementor's Ally accessibility plugin, confirm it is on 4.1.0 or later.

Attack campaign

Fake CAPTCHA campaign on hacked WordPress sites

Attackers broke into more than 250 legitimate WordPress sites in at least 12 countries and showed visitors a fake 'verify you are human' box that tricked them into running a command that installs password-stealing malware. The injected code hid itself from logged-in site owners, and the way in was not confirmed (likely an outdated plugin, stolen passwords or password guessing).

What to check · Visit your site logged out or in a private window to look for unexpected 'verify you are human' pop-ups, and turn on two-factor login for every admin.

Plugin

W3 Total Cache

900,000+

A bug in the plugin's 'dynamic fragment caching' feature could let an outsider run their own code on the site by posting a crafted comment, without logging in. Public exploit code was reported in late May 2026.

What to check · Update W3 Total Cache to the latest release (2.9.2 or later).

Plugin

WPvivid Backup & Migration

900,000+

A flaw in this popular backup plugin let an outsider upload a file and take over the site without logging in. Only sites that had turned on the non-default 'receive a backup from another site' option were exposed, for the 24 hours that the transfer key stays valid.

What to check · Make sure WPvivid is on 0.9.124 or later, and switch off 'receive backup from another site' when you are not mid-migration.