WordPress Security, September to October 2026: Is Your Site Safe?

Facts checked against WordPress.org's, Patchstack's, TeamUpdraft's and Rank Math's own pages on 24 October 2026. Some of these stories are still moving, so we will update this page if the advice changes.

Is my WordPress site safe?

Probably, if three things are true. Your site is on WordPress 7.1.3, the newest version when we checked on 24 October 2026. Your plugins and theme are up to date. And you don't use UpdraftPlus Premium, UpdraftCentral or Rank Math PRO, or you have already followed the steps for them below.

It has been a busy autumn for WordPress security. On 22 September WordPress 7.1.2 fixed a critical flaw, and a security company saw attackers trying it the same day. On 6 October WordPress 7.1.3 brought seven more security fixes. Then in mid-October two well-known plugins had their own incidents: malware got into one release of Rank Math PRO, and the company behind UpdraftPlus found someone had broken into its website and used it to reach customers' sites. Here is what happened, who it affects and what to check.

Key takeaways

• WordPress 7.1.3 came out on 6 October 2026 with seven security fixes. WordPress says to "update your sites immediately".
• WordPress 7.1.2, on 22 September, fixed a critical flaw that attackers started trying the same day. WordPress copies its security fixes back to older versions too, as far as 4.7, but only the newest version is officially supported.
• Most WordPress sites install security releases of WordPress by themselves. Plugins only update by themselves if someone has switched that on, plugin by plugin.
• If you use UpdraftPlus Premium or UpdraftCentral, make sure you are on UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium) or later, and look for users and plugins you didn't add, editors especially.
• If you use Rank Math PRO and downloaded version 3.0.123 on 15 or 16 October, follow Rank Math's steps. The free version of Rank Math is not affected.
• Some attacks this autumn created admin accounts that don't show on the Users screen. Looking at your site can't prove it is clean.

What happened, September to October 2026

WordPress 7.1.2 and 7.1.3: which version is safe?

WordPress 7.1.2 (22 September). WordPress called it a security release with "a fix for a critical severity security vulnerability" (WordPress.org). The flaw was in how WordPress picks a page template. Under certain conditions, someone with no login could make WordPress run a PHP file that was already on the server, and WordPress says that can lead to remote code execution: the attacker's own code running on your server. Its reference is CVE-2026-87902.

Patchstack, a WordPress security company, rates it 9.2 out of 10 (critical) and says it saw the first attack attempt at 11:49 UTC on 22 September, the day the fix came out (Patchstack). It lists the fixed releases as 7.1.2, 7.0.6, 6.9.9 and 6.8.10, "and backports to 4.7.37", so a site on an older branch could take the fix without a big jump in version. Those releases have since been replaced by the ones from 6 October, below, and WordPress's own version list now marks 7.1.2 and 4.7.37 as "insecure" (WordPress.org).

WordPress 7.1.3 (6 October). This release "features 7 security fixes and 4 bug fixes", and WordPress says "it is recommended that you update your sites immediately" (WordPress.org). WordPress released fixed versions for older branches the same day: its release archive lists 7.0.7, 6.9.10, 6.8.11 and others down to 4.7.38, all dated 6 October 2026 (WordPress releases). The 7.1.3 announcement still says those backports "are in progress", but the archive shows they are out.

What "safe" means here. WordPress is plain about its policy: "only the latest version of WordPress is officially supported", and its security team copies fixes back to older versions "as a courtesy" (WordPress.org). So the safe answer is the newest version, 7.1.3 when we checked. WordPress's own version list calls 7.1.3 "latest" and the older-branch releases from 6 October, such as 7.0.7 and 4.7.38, "outdated". An older branch with the latest fixes copied back is far better than an unpatched one, but it is living on goodwill.

How to check your WordPress version

Log in and go to Dashboard, then Updates. If you are up to date, WordPress says "You have the latest version of WordPress. Future security updates will be applied automatically." If not, the update button is on the same screen (WordPress.org).

You can also see the exact number under Tools, then Site Health, then the Info tab, in the WordPress section, where "Version" is "the version of WordPress you are currently using" (WordPress.org).

Does WordPress update itself?

WordPress itself, usually yes. WordPress's own handbook says automatic background updates came in with version 3.7 and "By default, automatic updates of WordPress are enabled on most sites", and that covers "Minor core updates, such as maintenance and security releases" (WordPress developer handbook). 7.1.2 and 7.1.3 are minor releases of that kind. Some hosts and developers switch automatic updates off, though, so check rather than assume.

Plugins and themes, usually no. Since WordPress 5.5, site administrators "can manually opt-in for automatic updates theme by theme and plugin by plugin" (WordPress.org). Unless someone has done that, your plugins wait for you. That matters, because most of this autumn's trouble was in plugins.

UpdraftPlus and UpdraftCentral: what to check

UpdraftPlus is a backup plugin with 3+ million active installations, by WordPress.org's count (WordPress.org). UpdraftCentral is the same company's service for managing many sites from one place.

On 19 October TeamUpdraft, the company behind both, said "Over the weekend of 17-18 October we identified unauthorised access to the teamupdraft.com website" (TeamUpdraft). It says the attacker used the connection between its service and customers' sites "to create admin accounts, install malicious plugins etc", and that "the extent of that is unknown". It has since asked "users of UpdraftPlus Premium to check your websites for signs of unusual activity … even if you've never used UpdraftCentral", and on 22 October it said it was "seeing a pattern of unexpected 'editor' roles especially". TeamUpdraft also says "We believe our customer database was accessed", and it has reported the incident to the Information Commissioner's Office (ICO).

The editor detail matters. Patchstack, which studied the attacks, says "The account shows as an Editor, so reviewing your administrator list misses it entirely" (Patchstack).

As of 23 October, when TeamUpdraft last updated its page, its advice comes to this:

1. Be on UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium) or later. TeamUpdraft says this update "automatically disconnects user sites from UpdraftCentral by revoking connection keys", and that WordPress.org pushed it out to all users. Check rather than assume.
2. Check your site for "unexpected plugins, activity and users", especially users with the editor role that you don't recognise.
3. If you have a teamupdraft.com account, change its password, and "Type teamupdraft.com into your browser rather than following a link". TeamUpdraft says free users with no teamupdraft.com account don't need to take that step, and that self-hosted UpdraftCentral is not affected.

TeamUpdraft is still updating its page, so read it yourself before you act.

Rank Math PRO 3.0.123: who is affected

Rank Math is an SEO plugin. Its makers say malware got into Rank Math PRO version 3.0.123, affecting "a limited number of users who downloaded Rank Math PRO v3.0.123 between October 15, 2026, at 20:02 UTC and October 16, 2026, at 07:12 UTC" (Rank Math). That is 21:02 on 15 October to 08:12 on 16 October, UK time. The clean version is 3.0.124.

"If you use the free version of Rank Math SEO available on WordPress.org, your website is not affected", Rank Math says. Wordfence, another WordPress security company, rates the problem 9.8 out of 10 (CVE-2026-111862) and warns: "Simply updating the plugin is not enough because the malware may have placed additional files, administrator accounts, or scheduled tasks elsewhere on the server" (Wordfence).

Rank Math's own steps depend on what you did with 3.0.123:

• Installed and activated it in that window: Rank Math says to treat your website as compromised, and "Deactivating the plugin alone is not sufficient." Its recommended fix is to restore the site and database from a backup made before 20:02 UTC on 15 October, run a security scan, change all passwords and credentials, then install 3.0.124.
• Installed it but never activated it: delete it, install 3.0.124 and run a security scan as a precaution.
• Downloaded it but never installed it: Rank Math says there is no sign from this incident alone that your site was compromised.

If restoring a backup isn't possible, Rank Math gives step-by-step clean-up instructions, and it says the order matters because the malware can rebuild itself. Unless you are comfortable working in your site's database and files, it recommends asking your host or a security professional to do it. Rank Math also says some free users' Rank Math account details may have been deleted while it refreshed its systems, and that it has emailed anyone affected. And it says to "always navigate to rankmath.com directly. We will never send login or download links by email."

Hidden admin accounts: the Ninja Forms and WPC Product Bundles attacks

On 6 October Patchstack described a campaign it first saw on 4 October, using a flaw in WPC Product Bundles for WooCommerce, and the next day a flaw in the Ninja Forms plugin (Patchstack). Once in, the attack "creates a WordPress administrator hidden from the Users screen, installs a backdoor login URL that authenticates as the site's original owner, and backdates its own files".

So the attacker gets a way back in that is built to go unnoticed. A glance at your Users screen would not show it, the account's name is picked to look routine (Patchstack gives "support", "updater", "maintenance" and "backup" as examples), and the files are dated to look old.

Patchstack says WPC Product Bundles has more than 30,000 active installations and Ninja Forms more than 500,000, and that the number of attacks it has seen is limited. It says the fixes are in WPC Product Bundles for WooCommerce 8.6.7 and Ninja Forms 3.15.4. If you use either plugin, check you are on that version or later. If your site ran an older version during October, have someone who can log in to the site and its files check it properly.

Also this month: Duplicator

On 20 October Wordfence published details of a flaw it found in Duplicator, a backup and migration plugin with more than one million active installations (Wordfence). It is rated 8.8 (high), CVE-2026-82814, and affects Duplicator 1.5.17 and older and Duplicator Pro 4.6.10 and older. The fix came out in September, in Duplicator 5.0.0, and Wordfence doesn't report any attacks. Its advice: "update to version 5.0.0 or a newer version as soon as possible."

Signs your WordPress site may have been hacked

WordPress.org's own help page says the clearest signs are things happening that nobody authorised, "creation of new users" for example, and seeing the hack yourself when you open the site in a browser (WordPress.org). From this autumn's incidents, look for:

• users you don't recognise, especially administrators and editors;
• plugins you didn't install;
• anything odd when you open the site, such as pages, links or redirects you didn't add;
• your emails suddenly landing in spam, which WordPress.org says can happen when a hacked site is used to send spam from the same server.

Not finding any of these doesn't prove a site is clean. The hidden accounts above are designed to stay out of sight, and an outside look at a site can't see its user accounts or every plugin it has installed. WordPress.org suggests checking with your hosting company too, because a hack on shared hosting can reach beyond one site.

What to do this week

1. Back up your site before changing anything. WordPress's handbook says a backup plan "can help you get back online faster in the case of a problem" (WordPress developer handbook).
2. Update WordPress from Dashboard, then Updates.
3. Update every plugin and your theme, and delete the ones you no longer use. Patchstack found 91% of the new WordPress security flaws it counted in 2025 were in plugins (Patchstack).
4. Check your Users and Plugins screens for anything you don't recognise.
5. If you use UpdraftPlus Premium, UpdraftCentral or Rank Math PRO, follow the steps on TeamUpdraft's and Rank Math's own pages.
6. If anything looks wrong, reset the passwords for every user, administrators first, which is what WordPress.org suggests once you identify a hack, and tell your host.

Our Website Security Checklist for Small Businesses covers the routine after that.

Watch out for fake "WordPress update" emails

News like this brings out scammers, and TeamUpdraft itself warns people to be cautious of unexpected emails that claim to be from it.

It has happened to us. On 22 October an email went out in our co-founder Harriet's name, from a Gmail address, with the subject "Important WordPress Platform Update for Your Website". It wasn't from us. We build on Next.js, never WordPress, and we only ever email from an @brambla.co.uk address. If an email asks you to update, log in, pay or click a link about your website, contact the company on a number or address you already have, and forward the email to report@phishing.gov.uk (GOV.UK). How we contact our clients is set out on How we contact you.

If keeping up with this feels like too much

Our view: none of this autumn's problems means WordPress itself is finished. A site on 7.1.3 with up-to-date plugins and someone checking it is in a good place. What goes wrong is a site nobody is looking after, where plugins sit for months and nobody checks the users.

Where we stand. The sites we build are custom-built on Next.js and hosted on Vercel, and we don't use WordPress for our builds (How we build), so there are no WordPress plugins on them to go wrong. No platform is immune to security flaws, though. The difference is who is watching: on our plans we run the site for you, security and backups included.

Want to know where your site stands? Our Website Audit has two options. The free Mini Audit checks your homepage's clarity, takes a mobile and speed snapshot and gives a basic SEO overview. It is not a security check. The £149 Full Website Audit adds a technical health check of hosting, security and outdated plugins, and the fee is credited back if you then start a project with us.

Thinking of moving off WordPress? Our 7 Day Website starts from £1,200, run on WebsiteCare from £65 a month, or our pay monthly website plans are a free build from £30 a month, and we run the site for you; because the site is part of the service, it comes down if you cancel. WordPress sites are not part of our standard WebsiteCare plans: if you want us to look after one, we review the site and its hosting first, then give you a quote.

Frequently Asked Questions

What is the latest version of WordPress?

WordPress 7.1.3, released on 6 October 2026, was the newest version when we checked on 24 October 2026. WordPress lists every release on its releases page.

Does WordPress update automatically?

WordPress itself usually does: automatic updates for maintenance and security releases are on by default on most sites, according to WordPress's own handbook. Plugins and themes only update automatically if an administrator has switched that on for each one. Your Dashboard's Updates screen shows what is waiting.

My site is on an older version of WordPress. Is it safe?

Only the newest version is officially supported. WordPress copies security fixes back to older versions "as a courtesy": on 6 October 2026 it released 7.0.7, 6.9.10, 6.8.11 and others down to 4.7.38 alongside 7.1.3. So an older site may have the latest fixes if its automatic updates are working, but WordPress's own version list calls those releases "outdated". The safe move is to update to the newest version, testing first if the site is old.

Is UpdraftPlus safe to use now?

TeamUpdraft says the problem started with a break-in at its own website, and Patchstack says it is not a flaw in the plugin itself. TeamUpdraft says versions 1.26.13 (free) and 2.26.13 (Premium) cut sites off from its UpdraftCentral service by revoking the connection keys. As of 23 October 2026, be on those versions or later, check your site for users and plugins you didn't add, and keep an eye on TeamUpdraft's incident page, which it is still updating.

Is the free version of Rank Math affected?

No. Rank Math says the free version on WordPress.org is not affected. The problem was in one release of Rank Math PRO, version 3.0.123, downloaded during an 11-hour window on 15 and 16 October 2026.

How do I check my WordPress version?

Go to Dashboard, then Updates, in your WordPress admin. It tells you whether you have the latest version. For the exact number, go to Tools, then Site Health, then Info, and open the WordPress section.

Can you tell from the outside if a WordPress site has been hacked?

Sometimes. Spam links, strange redirects or a warning in the browser can show from the outside. But an outside look can't see a site's user accounts or every plugin it has installed, and some attacks this autumn were built to hide admin accounts. So an outside check can find some problems, but it can't prove a site is clean.

Related reading

• PHP Security Update: What to Do When a Critical Flaw Hits Your Website (October 2026)
• Website Security Checklist for Small Businesses
• Website Security for Small Businesses: The Complete 2026 Guide
• Complete Guide: WordPress Maintenance vs Rebuild: What a Care Plan Never Fixes