WordPress Security in October 2026: What to Update

On the afternoon of Tuesday, October 20, two CVE numbers started moving through security forums and social media. They came with a wrong release time and a wrong severity score, and no technical details. What they pointed to was real. The PHP project had spent weeks preparing fixes for two flaws in PHP itself, the language WordPress is written in, and the secret was out two days early.

Most months, WordPress security is a story about plugins. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025. Ninety-one percent were in plugins. WordPress core had six, all low priority.

October went deeper. The trouble reached the language, the core update process, and the services site owners pay to keep them safe. Here is what happened, roughly in order of how far down it went, and what to check on your own site.

PHP itself broke

BleepingComputer puts PHP behind roughly 70 percent of all websites. The two bugs, now called PHP2Shell (CVE-2026-109618 and CVE-2026-109619), live in memory handling and error handling, code that nearly every request touches. Both are rated 9.2 out of 10.

On Apache with mod_php, the PHP Foundation says, an attacker with no account could trigger one of them before any application code runs. Researchers showed full remote code execution with default settings.

The bug wasn't new. The first signs of the memory problem turned up in 2024, during PHP's first outside security audit in years. Nobody could show a working exploit, and every proposed fix broke something else. Work stalled and restarted for months. "We won't pretend otherwise," the Foundation wrote. "The delay was a structural failure."

In August 2026, a researcher at the security firm Calif reported a working remote code execution with the same root cause. Wiz and OpenAI followed with more attack paths. From then on, fixing it was the Foundation's top security priority, and people worked through weekends to get it out.

Then the disclosure came apart. The CVE numbers leaked on October 20. That evening Calif mistakenly posted a video of its exploit working against a number of targets, and copies spread after it was deleted. Early the next morning, more than six hours before the coordinated release, Chainguard published patched images, which let anyone study the fix while most PHP users still had nothing to install. PHP shipped 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on October 21, a day ahead of schedule.

Rapid7 found that the public exploits worked only under narrow conditions, and called that "a window to patch rather than a reason to delay." The window closed fast. On October 26, CISA added both flaws to its catalog of known exploited vulnerabilities and gave federal agencies three days to fix them.

CISA's advice for one group was blunt. Organizations still running PHP 8.1 or older "should take PHP-based systems offline until they can be patched or updated."

That group is large. WordPress.org publishes the PHP versions its sites report. As of early November, about 33 percent of WordPress sites run PHP 8.1 or older, every one of them past end of life. Nearly 15 percent run PHP 7.4, which stopped getting fixes in November 2022. Another 23 percent run PHP 8.2, which reaches end of life on December 31.

There is some cover. For this emergency, PHP released limited source patches for 7.4, 8.0, and 8.1, and Linux distributions got the fix in advance. Distribution packages can carry the fix while keeping the old version number, so the number alone won't tell you whether you're exposed.

What to do:

• Find your PHP version. In WordPress, go to Tools, then Site Health, then Info, and open Server.
• Ask your host whether that build includes the October 21 fixes.
• If you're on 8.1 or older, plan the upgrade now. If you're on 8.2, you have until December 31.

The tools you trust became the way in

Over the weekend of October 17 and 18, someone got into teamupdraft.com, home of UpdraftPlus, a backup plugin with more than four million active installations. TeamUpdraft believes its customer database was accessed. That database held connection keys for UpdraftCentral, the company's service for managing many WordPress sites from one dashboard.

Those keys can send commands to every connected site. Patchstack watched an attacker use them to install backdoor plugins without a break across an 18-hour window on October 18 and 19, and counted 99 different plugin names. Nethemba, the Slovak firm that first spotted the attack, found that the backdoor created an account with a known password. That account stays on the site after the plugin is removed, and the attacker can log in through the normal login form "unless two-factor authentication is enabled for that account."

TeamUpdraft pushed UpdraftPlus 1.26.13 and 2.26.13 on October 19 to revoke the old keys. Its October 29 update adds a harder lesson. On a few sites, a plugin the attacker left during the incident sat quietly and was later used to create a new administrator, after the site had already been disconnected. Some of these plugins hide from the Plugins screen. Some hide accounts from the Users screen.

The same week, the download for Rank Math PRO, an SEO plugin, was poisoned. Anyone who downloaded version 3.0.123 during an 11-hour window on October 15 and 16 got a copy with hidden backdoors. Version 3.0.124 fixes it.

What to do, if any site was ever connected to UpdraftCentral Cloud:

• Update UpdraftPlus, then delete every existing key under Settings, UpdraftPlus, Advanced Tools, UpdraftCentral.
• Check wp-content/plugins and wp-content/mu-plugins through your host's file manager or SFTP, not only the dashboard.
• Don't delete a suspicious plugin from the dashboard. TeamUpdraft says some of them erase evidence when removed that way.
• Reset passwords and WordPress security keys, then turn on two-factor login for every admin.

If you run Rank Math PRO, confirm you're on 3.0.124 or later.

WordPress 7.1.4 and a race measured in seconds

WordPress 7.1.4 came out on October 28 with 22 security fixes. Most are cross-site scripting bugs that need someone logged in with at least contributor access.

One sits in the core update process itself. When WordPress unpacks a full update, it drops the new files into a staging folder with a predictable name, and many servers make that folder reachable from the web. An attacker who reaches it in the seconds before WordPress cleans up can run code, with no account.

That's a hard shot. Attackers tried it anyway. Defiant, the company behind Wordfence, said the first hit on its new firewall rule came nine minutes after it went live. In the first 21 hours it logged more than 18,500 requests aimed at those installer paths. It hasn't reported a successful break-in.

It capped a rough few months for core. In July, WordPress 7.0.2 fixed "wp2shell," a pair of flaws that together let an attacker with no account create an administrator, and CISA confirmed active exploitation four days after the advisory. In September, 7.1.2 fixed a path traversal flaw, and Patchstack saw attackers probing it less than five hours after the release. WordPress 7.1.3 added 7 more security fixes in early October.

What to do:

• Go to Dashboard, then Updates, and confirm you're on 7.1.4. Older branches got their own fixes, such as 7.0.8 and 6.9.11, back through 4.7.
• Don't assume automatic updates ran. Check.

A form submission that waits for you

The most patient attack of the month needs a person on your team to help, and it gets that help by waiting.

On October 4, Patchstack saw the first attempts in a campaign it described as "four ways back in". The attacker fills out a form on your site and hides a script inside the submission. It uses two plugins:

• Ninja Forms through 3.15.3, on more than 500,000 sites. Fixed in 3.15.4.
• WPC Product Bundles for WooCommerce through 8.6.6, on more than 30,000 sites. Fixed in 8.6.7.

Nothing happens until someone opens that submission in wp-admin. Then the script runs as that person, with their permissions. It installs a fake plugin called WP Smart Thumbnails and creates an administrator. It creates a second administrator that doesn't appear on the Users screen and isn't counted in the totals above the list. It adds a secret login link that signs the holder in as the site's oldest administrator. Then it stamps its own files with the oldest date it can find, so they look older than WordPress itself. The fake plugin also carries a file manager that needs no password at all.

The domain serving the script was registered on October 1. The two flaws had been made public on September 22. Patchstack says the volume is limited so far, and that two plugins is what it has confirmed, not where it expects the count to end.

Removing the vulnerable plugin, or even the fake one, closes none of the three hidden ways back in.

What to do:

• Update Ninja Forms to 3.15.4 or later, and WPC Product Bundles to 8.6.7 or later.
• Look for a wp-smart-thumbnails folder in your plugins and for unfamiliar files in wp-content/mu-plugins.
• Ask your developer or host to list administrators straight from the database and compare that list with the Users screen. An account that shows up in one and not the other is a bad sign.
• If you find any of this, treat the site as compromised and get help cleaning it. Updating alone won't fix it.

Bricksforge and a picture that was also a program

Bricksforge is an add-on for the Bricks Builder plugin, used on about 6,000 sites. Patchstack first saw attacks on its upload flaw on October 7. The flaw is rated 10.0, the highest score.

The trick is a file that is a valid GIF image and a PHP program at the same time. It passes the image check, and Bricksforge then trusts the attacker's word about where to save it, with a .php name. In one cluster, 44 different IP addresses sent identical requests within seconds of each other.

What to do: if you use Bricksforge, update to 3.1.8.10 or later.

The volume never stops

Wordfence publishes a weekly count. For October 19 to 25, it added 268 vulnerabilities across 182 plugins and 15 themes. Forty-three had no patch yet when the report came out.

Speed is the other half. Patchstack found that the most heavily attacked flaws of 2025 drew their first exploit attempts a median of five hours after disclosure, and that 46 percent of vulnerabilities had no fix from the developer when they went public.

Most of those plugins aren't on your site. A few probably are, and you won't hear about them unless someone is watching.

The breach that went through an old website

Not every incident is a WordPress story. On September 30, attackers got into the Archives & Records Association's membership renewal portal, along with a database attached to the association's old website, the one it replaced in 2021.

The records reached back to 2013. Names, membership numbers, emails, addresses, and payment references were exposed. Card details were not. Anyone who had logged in to the old site with a password was told that password may be compromised.

The detail to keep is the old website. The association had moved on in 2021. The database behind the old site was still reachable in 2026. Renewal forms, donation forms, and event sign-ups all collect supporter data, and that data tends to outlive the site that collected it.

The short list

1. Confirm your PHP version is supported and that your host has applied the October 21 fixes.
2. Confirm WordPress is on 7.1.4 or your branch's patched release.
3. Update every plugin, starting with forms, page builders, and anything that connects to an outside service.
4. Compare the admins in your database with the admins on your Users screen.
5. Turn on two-factor login for every admin.
6. Make sure you have a recent backup you've restored, and one old enough to predate a problem you haven't found yet.
7. Take old sites and databases offline.

Common questions

Which WordPress version should my site be on? WordPress 7.1.4, released October 28, 2026, or the patched release for your branch, such as 7.0.8 or 6.9.11. Check Dashboard, then Updates.

Which PHP version should my site be on? A supported one. As of November 2026 that means PHP 8.2 through 8.5, and 8.2 reaches end of life on December 31, 2026. The October fixes for PHP2Shell shipped in 8.5.12, 8.4.27, 8.3.36, and 8.2.35. If you're on 8.1 or older, ask your host whether your build is patched and plan the upgrade.

Is updating Ninja Forms enough if my site was hit? No. Patchstack found that the attack leaves a hidden administrator and a backdoor login that stay after the plugin is updated or removed. Update to 3.15.4 or later, then check for accounts and files you did not add.

We used UpdraftCentral. Are we affected? If a site was ever connected to TeamUpdraft's cloud UpdraftCentral, TeamUpdraft asks you to check it even if nothing looks wrong. Update UpdraftPlus to 1.26.13 or 2.26.13 or later, delete old connection keys, and look for plugins and accounts you did not add, in your files as well as in the dashboard.

Do automatic updates cover the WordPress 7.1.4 fix? If your site supports automatic background updates, WordPress starts the update on its own. Check that it finished rather than assuming it did.

If you'd rather not track this every week, we do it for our retainer clients.