Security alerts
What to fix right now.
Short alerts when a serious flaw hits sites like yours: what happened, who is affected, how to check your site and what to do. The important ones from the past year are here too, in case you missed them. Every alert cites its official sources.
Security alerts
October 2026
UpdraftCentral keys stolen to plant malicious plugins: update UpdraftPlus and check
Stolen UpdraftCentral keys were used to add admin accounts and malicious plugins to connected WordPress sites.
Some Rank Math SEO PRO 3.0.123 downloads contained malware: check and install 3.0.124
Copies of Rank Math SEO PRO 3.0.123 downloaded on October 15 and 16, 2026 carried malware. The free plugin is not affected.
September 2026
WordPress core file inclusion flaw exploited: make sure you run 7.1.2 or a patched branch
A WordPress core flaw lets anyone without an account load files from the server, and on some setups run code.
Ninja Forms and WPC Product Bundles flaws used to hide admin accounts: update and check
Attackers used flaws in Ninja Forms and WPC Product Bundles to plant code that creates hidden administrator accounts.
August 2026
Elementor Pro form upload flaw exploited: update to 4.2.2 or later
A flaw in Elementor Pro forms let anyone upload a malicious file and take over the site. Attacks began on the day of the fix.
July 2026
WordPress core wp2shell flaws exploited: confirm you run 7.0.2, 6.9.5 or 6.8.6
Two WordPress core flaws let anyone take over a site without logging in. Attacks began the day of the fix.
October 2025
Post SMTP plugin flaw exploited to take over admin accounts: update to 3.6.1 or later
Post SMTP let anyone read the site's email logs, including password reset emails, and take over an administrator account.