Over the past few weeks, attackers have kept breaking into WordPress sites through plugins, often within hours of a fix being released. If you run WordPress or WooCommerce, here is what happened, what it means for you, and a short checklist you can finish today.
Last updated: 25 October 2026. The details below come from security researchers and are still developing.
Key takeaways
- Several WordPress plugins are being exploited right now, including a page builder add-on, a WooCommerce add-on and a popular forms plugin.
- Attackers often start within hours of a patch, so updating late is the main risk.
- Plugins you no longer use still count as code on your server. Remove them.
- A new backdoor can rebuild itself after cleanup, so deleting a single file is not enough.
What happened this month
Bricksforge: upload and run code without logging in
Bricksforge is a commercial add-on for the Bricks page builder. A flaw tracked as CVE-2026-85097 lets an attacker who is not logged in upload files and run PHP code on the site, which can mean full takeover. Patchstack first saw attack attempts on 7 October. Versions up to 3.1.8.9 are affected, and the fix first shipped in 3.1.8.10. Different sources score it between 9.8 and 10.0 out of 10. Some attackers tried to drop files named like login_admin_something.php into normal upload folders.
WPC Product Bundles for WooCommerce and Ninja Forms
Two unrelated plugins had stored cross-site scripting flaws, disclosed on 22 September and exploited from 4 October. They affect WPC Product Bundles for WooCommerce up to version 8.6.6 and Ninja Forms up to 3.15.3. Patchstack describes a campaign where the injected code installs a plugin that hides its own administrator account, so you may not see the intruder in your Users list.
UpdraftCentral keys abused
On 18 and 19 October, attackers abused stolen UpdraftCentral keys. This is not a bug that an update can fix. Patchstack’s advice is to delete any UpdraftCentral keys you do not need, and the same logic applies to any remote management key.
Elementor Pro: a recent reminder
In August, Elementor Pro versions up to 4.2.1 had a flaw (CVE-2026-32475) in the Forms module that let attackers upload files without logging in. The fix arrived in 4.2.2 on 19 August, and attacks began on release day. If you use Elementor Pro, make sure you are on 4.2.2 or newer.
A backdoor that rebuilds itself
On 1 October, researchers described WordPress malware that hides in several places at once: a must-use plugin, a caching drop-in file, the database, a ZIP bundle and even shared memory. If you delete one copy, another recreates it. How it first gets in is not known, but the usual routes are vulnerable plugins, weak passwords and insecure upload features.
The real lesson: speed
Patchstack measured that, for the heavily exploited WordPress flaws of 2025, the typical time to mass exploitation was about five hours. A security patch is also a map for attackers, because it shows them exactly what to look for. There is also a long tail. An old bug in a WooCommerce wholesale plugin was fixed in February and was still being attacked through the summer, because many sites never updated.
WordPress itself is also moving fast. Two serious core flaws were exploited this year, and the fixes arrived as automatic updates. That is why keeping core security updates automatic matters. Do not forget the layer underneath: I covered the recent PHP flaws in this PHP security update guide.
Your 10-minute checklist
- Update everything. Update WordPress, plugins and themes. If you use Elementor Pro, check it is 4.2.2 or newer. If you use Bricksforge, Ninja Forms or WPC Product Bundles, update them now.
- Delete what you do not use. Inactive plugins and themes still sit on the server and can still be attacked.
- Remove remote management keys you do not need, such as UpdraftCentral keys.
- Look for PHP files in your uploads folder. That folder should hold images and documents, not PHP code. Pay attention to anything named like
login_admin_*.phpand to files underuploads/elementor/forms/. - Check your users. Look for administrators you do not recognise. Because some attacks hide their own account, also ask your host or developer to list administrators from the database.
- Check must-use plugins and drop-ins. Look at
wp-content/mu-pluginsand files likeadvanced-cache.phpfor names you do not recognise. Caching plugins create some of these legitimately, so compare against what you installed. - Turn on automatic core security updates and decide who patches an exploited plugin the same day.
- Protect logins. Use strong passwords and two-factor authentication for every administrator, and give automation accounts the narrowest role they need.
- Block PHP from running in the uploads folder. If an attacker ever gets a file in, this stops it from executing. Ask your host if you are not sure how.
- Keep an off-site backup and test that you can actually restore it.
If you find something suspicious
Do not just delete one file. Keep a copy for evidence, put the site in maintenance mode and restore a clean backup from before the problem. Then update everything, remove unknown administrators, and change all passwords, keys and security salts. Scan again afterwards. If you are not sure the site is clean, it is worth getting help, because a single missed copy can bring the infection back.
How I can help
My Website Security service covers a security audit, malware scan and cleanup, and clear next steps. If you would like me to look at your site, send me a message with a few details and I will tell you what I would check first.
Frequently asked questions
Are inactive plugins really a risk?
Yes. An inactive plugin is still files on your server. Some vulnerable files can be reached directly even when the plugin is switched off, so remove what you do not use.
Do I need to update immediately?
For plugins that are being exploited, yes, the same day if you can. For other updates, a regular schedule with a quick check of your key pages afterwards is reasonable.
How can I tell if my site was hacked?
Warning signs include unknown administrators, PHP files in the uploads folder, unexpected redirects, spam pages, and security warnings from your host or browser. A scan helps, but it is not a guarantee, which is why the checklist above looks at files and users directly.
Is a free security plugin enough?
It helps, but it does not replace updates. A firewall can block known attacks, while patching removes the weakness. You need both, along with backups.
Sources
- SecurityWeek: Bricksforge vulnerability exploited in the wild
- The Hacker News: Bricksforge flaw under attack
- The Hacker News: WordPress backdoor rebuilds itself
- Professional IT Services: WordPress plugin vulnerabilities, Q3 2026
- Patchstack: Elementor Pro unauthenticated file upload
- Patchstack: XSS campaign that hides its own admin account