Guide · WordPress security

October's WordPress plugin attacks: what to check on your site

October was a bad month for WordPress even before the PHP flaw. Stolen keys turned a popular backup plugin into a way to plant backdoors, a page-builder add-on let strangers upload code, a paid SEO plugin shipped malware in one update, and a campaign through two form and shop plugins created admin accounts that hide themselves. Here is which plugins were involved, which versions are safe, and how to tell if someone already got in.

By Elliot · Published 26 October 2026 · 9 min read

Do these today

UpdraftPlus: update to 1.26.13 or later and delete any UpdraftCentral keys.
Rank Math SEO PRO: if your site updated to 3.0.123 on 15 or 16 October and it was active, treat the site as hacked. 3.0.124 is clean.
Bricksforge, Ninja Forms or WPC Product Bundles: update now, then check for the signs below.
Delete Front End Users and Advanced Twenty Seventeen if you have them. They have no fix.
An update closes the door. It does not remove anyone already inside.

What happened

Three attack campaigns and a poisoned update

UpdraftCentral, 18 and 19 October. UpdraftPlus is one of the most popular backup plugins, with over three million installs. Its maker, TeamUpdraft, says it found unauthorised access to its website over the weekend of 17 and 18 October, believes its customer database was accessed, and has reported it to the ICO and the police. Keys for its UpdraftCentral remote-management service were then used to install backdoor plugins on live sites overnight. The plugin's code was not the flaw; the keys were.

Rank Math SEO PRO, 15 and 16 October. Some copies of version 3.0.123 of the paid edition of the Rank Math SEO plugin contained malware. Rank Math says the affected copies were downloaded or installed through an update between 20:02 UTC on 15 October and 07:12 UTC on 16 October, that any site which activated one should be treated as compromised, and that the malware can rebuild its own backdoor when the site is visited. Version 3.0.124 is the clean replacement. The free Rank Math plugin on wordpress.org was not affected.

Bricksforge, from 7 October. A paid add-on for the Bricks page builder let anyone upload a PHP file through its form handler and then run it, with no login. Patchstack saw the first attacks hours after disclosure, from 63 different addresses. Ninja Forms and WPC Product Bundles, from 4 October. A smaller campaign used stored script flaws in both to create admin accounts that hide themselves from the Users screen.

October 2026 WordPress plugin issues, and the version that fixes each
Plugin	The problem	Safe version	Attacked?
UpdraftPlus (UpdraftCentral keys)	Stolen remote-management keys used to install backdoor plugins	1.26.13 or later, then delete UpdraftCentral keys	Exploited 18 to 19 Oct
Rank Math SEO PRO (paid version)	Some copies of 3.0.123 shipped with malware that builds a backdoor	3.0.124, from your Rank Math account	Poisoned 15 to 16 Oct
Bricksforge (Bricks Builder add-on)	Anyone could upload a PHP file and run it, no login needed	4.0.2 (3.1.8.10 on the old line)	Exploited from 7 Oct
Ninja Forms	Stored script injection used to plant hidden admin accounts	3.15.7 (the attacked flaw was fixed in 3.15.4)	Exploited from 5 Oct
WPC Product Bundles for WooCommerce	The same campaign, through a WooCommerce add-on	8.7.3 or later (the attacked flaw was fixed in 8.6.7)	Exploited from 4 Oct
Duplicator	A booby-trapped comment can run code when an old package is used to move a site	5.0.0 or later, then make fresh packages	Not reported exploited
Prime Mover	Code injection that fires when an admin runs an export or restore	2.2.2 or later	Not reported exploited
User Profile Builder	Four lower-severity flaws, separate from July's critical one	4.0.5 or later	Not reported exploited
Front End Users, Advanced Twenty Seventeen	Closed on wordpress.org on 13 October with no fix	Remove them	Not reported exploited
WordPress itself	Seven security fixes in a maintenance release on 6 October	7.1.3	Not reported exploited

The bigger picture

Why plugins are where WordPress gets attacked

Patchstack's count of the WordPress ecosystem in 2025, from its 2026 report.

11,334

new vulnerabilities in WordPress plugins, themes and core in 2025, up 42%

Source: Patchstack

91%

of them were in plugins. WordPress core had six, all low priority

Source: Patchstack

5 hours

median from disclosure to first attack, for the most heavily attacked flaws

Source: Patchstack

WordPress runs 39.6% of all websites, according to W3Techs, and most of them carry a dozen or more plugins written by different people with very different security habits. WordPress itself is rarely the weak point. October bears that out: the core release on 6 October fixed seven issues with no attacks reported, while four plugin problems were attacked within days.

The five-hour figure is the one that matters for a small business. Nobody checks their plugins every five hours, which is why automatic updates, backed by a backup you have actually tested, now do more for a typical site than any security plugin. Patchstack also found that 46% of the vulnerabilities it logged had no fix at the moment they were made public.

Already compromised?

Six signs someone got in before you updated

Taken from the researchers' published indicators. Some need your host or developer to check.

Plugins nobody remembers installing

The UpdraftCentral attackers used 99 different backdoor plugin names, with "Site Health Cache" turning up often. The other campaign used a fake plugin called "WP Smart Thumbnails". Anything on your Plugins screen that nobody can account for needs explaining before it is trusted.

Admin accounts you did not create

Look for users named like two words and two digits (data-ops43, media-staff96) with example.org email addresses, or listed as Editor but able to install plugins. TeamUpdraft says unexpected Editor accounts are the pattern it sees most. Some backdoors hide their admin from the Users screen entirely, so only a database check by your host or developer will find it.

PHP files in the uploads folder

Uploads should hold images and documents, never PHP code. The Bricksforge attacks left files such as login_admin_*.php in the plugin's temporary upload folder. Your host can search for PHP files under wp-content/uploads in a minute.

Files in the must-use plugins folder

The admin-hiding campaign dropped files named like class-wp-query-[letters and numbers].php into wp-content/mu-plugins, a folder that loads on every page and does not appear on the normal Plugins screen. Most small sites have nothing in it at all.

A strange way to log in

One backdoor added its own entrance, a login address ending in ?_wplogin=, so the attacker can return even after passwords change. Odd login activity in your security plugin or host logs, from accounts or places you do not recognise, deserves a closer look.

Settings and tasks you did not add

Researchers listed database options such as _sync_token and fz_emer_login_tokens, and calls out to domains called imgcdn1.com and, in the Rank Math incident, rank1cdn.com. These are for your developer or host to search for. If any turn up, treat the site as compromised, not as needing an update.

What to do

Checking a WordPress site, step by step

Steps one to five take under half an hour on a typical small-business site. Step six only applies if one of the attacked plugins was out of date at the wrong time.

List every plugin, including inactive ones

Open Plugins in your WordPress dashboard, or Tools, Site Health, Info, which lists active and inactive plugins with their versions. Inactive plugins still sit on the server and can still be attacked, so they count too. Write the list down; you will need it if anything is wrong.

Update to the safe versions in the table

Check each plugin against the table above and update anything older, along with WordPress itself to 7.1.3. Bricksforge and Rank Math SEO PRO are paid, so they only update with an active licence. If you use Duplicator to move sites, make fresh packages after updating rather than reusing old ones. Take a backup first, then click through your contact form, bookings and checkout afterwards.

UpdraftPlus users: delete the remote keys

Updating to 1.26.13 revokes the stolen keys, but TeamUpdraft also asks you to remove them: Settings, UpdraftPlus Backups, Advanced Tools, UpdraftCentral. If you never used UpdraftCentral or the cloud migrator, there may be nothing there, which is good news.

Delete plugins that have been closed

A plugin closed on wordpress.org can no longer be downloaded, and the two closed on 13 October have no fix. Deactivating is not enough; delete them. If you rely on what one did, ask your developer for a maintained replacement rather than keeping it.

Switch on automatic updates for plugins

Since WordPress 5.5 every plugin has an Enable auto-updates link on the Plugins screen, and a bulk action does several at once. WordPress then checks twice a day and emails you what changed. With a working backup behind it, this is the single change that shortens the window an attacker gets.

If you were exposed, assume you were hit

If an affected version was live during its attack dates, updating does not remove anything already planted. Ask your host to check for the signs above, restore from a backup taken before the attack, then change every password (WordPress, hosting, FTP, database) and replace the secret keys in wp-config.php, which signs everyone out.

Headlines to treat with care

What the October roundups got wrong

Two of the most shared “October” stories are older. The critical User Profile Builder flaw was fixed in July and has not been reported as exploited. The “300,000 sites exposed” form-plugin headline is Forminator, fixed at the end of July and also not exploited; the number was an estimate of half its installs. One roundup listed MAS Videos as closed with no fix; it is open again, with a fixed release on 20 October.

Numbers vary too. You will see “400,000 UpdraftPlus sites exposed”, derived from about one in ten installs using a remote key; TeamUpdraft's own page does not state it, and nobody has published how many sites were actually backdoored. Bricksforge has two severity scores, 10.0 from Patchstack and 9.8 on the official CVE record, because two organisations scored it. Both mean the same thing: update now.

As with every security guide we write, we cannot tell whether your site was hit by looking at it from the outside, and we never try the attacks on a site we do not own: that is unauthorised access under the Computer Misuse Act, however good the intention. The people who can check are whoever runs your hosting and your WordPress install.

FAQ

WordPress plugin security questions

Which WordPress plugins were attacked in October 2026?

Three campaigns were seen exploiting real sites in October 2026: stolen UpdraftCentral keys used to install backdoors through UpdraftPlus on 18 and 19 October, an unauthenticated file upload flaw in the Bricksforge add-on from 7 October, and a campaign through Ninja Forms and WPC Product Bundles for WooCommerce from 4 and 5 October that planted hidden admin accounts. Separately, some copies of the paid Rank Math SEO PRO 3.0.123, downloaded on 15 and 16 October, contained malware. All are fixed in current versions.

What happened with UpdraftPlus and UpdraftCentral?

TeamUpdraft, which makes UpdraftPlus, says it found unauthorised access to its website over the weekend of 17 and 18 October 2026, believes its customer database was accessed, and reported it to the ICO. Keys that connect sites to its UpdraftCentral remote management service were then used to install backdoor plugins on live sites. Version 1.26.13 revokes the keys. Site owners should also delete UpdraftCentral keys in the plugin's settings and check for unknown plugins and users.

Is UpdraftPlus safe to keep using?

The plugin's code was not the problem; the keys for its remote management service were. Updating to 1.26.13 or later and deleting old UpdraftCentral keys deals with the route that was used. Whether to keep using UpdraftCentral itself is a judgement call, but backups remain essential, and UpdraftPlus is still one of the most widely used ways to take them.

Is the Rank Math SEO plugin safe?

The free Rank Math SEO plugin from wordpress.org was not affected. Some copies of the paid Rank Math SEO PRO 3.0.123, downloaded or installed through an update between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026, contained malware. Rank Math says a site that activated one of those copies should be treated as compromised and restored from a backup taken before the window. Version 3.0.124 is the clean replacement.

Will updating a plugin remove a hack?

No. An update closes the hole an attacker used, but anything they installed while it was open stays, including backdoor plugins, hidden admin accounts and files in the uploads folder. If a vulnerable version was live during an attack window, have the site checked and, if needed, restored from a backup taken before the attack.

Was User Profile Builder hacked in October 2026?

The critical User Profile Builder flaw that circulated in October news, CVE-2026-15826, was fixed in version 3.16.5 in July 2026 and has not been reported as exploited. In October the plugin fixed four separate, lower-severity flaws in version 4.0.5. Update to 4.0.5 or later and it is covered either way.

How many WordPress vulnerabilities are there?

Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than in 2024, with 91% of them in plugins and only six in WordPress core. For the most heavily attacked flaws, it measured a median of about five hours from public disclosure to the first exploitation attempt.

Is this connected to the PHP2Shell vulnerability?

No. PHP2Shell, fixed on 21 October 2026, is a flaw in PHP itself, the language WordPress runs on, and it is fixed by your host updating PHP. The October plugin attacks are flaws in specific plugins and a stolen set of keys, fixed by updating those plugins. A WordPress site can need both.

References