Quick answer: WordPress security news in 2026 is about speed. A core remote-code-execution chain (wp2shell) landed in July, three core security releases shipped in under three weeks this autumn, a CVSS 10 plugin flaw was hit a day before disclosure, stolen UpdraftCentral keys backdoored sites, and PHP issued an emergency fix on October 21. Update PHP, core and plugins now.
Key takeaways
- In July, a pre-login takeover chain called wp2shell (CVE-2026-63030 and CVE-2026-60137) hit WordPress core, and public exploit code appeared the next day.
- WordPress shipped security releases 7.1.1 (Sept 17), 7.1.2 (Sept 22) and 7.1.3 (Oct 6). Version 7.1.2 fixed a critical flaw, CVE-2026-87902.
- PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is fixed by updating PHP. A WordPress update will not help.
- Plugins stay the weak spot: Patchstack counted 11,334 new WordPress ecosystem vulnerabilities in 2025, and 91% were in plugins.
- Stolen credentials are now an attack path. UpdraftCentral keys let attackers install backdoors without exploiting any bug on the victim’s site.
- Updates, fewer plugins, rotated secrets and monitoring stop most of this.
TL;DR: Check your PHP version, update WordPress to the latest release, update or remove risky plugins, delete UpdraftCentral keys if you ever connected one, and rotate any secret that might have leaked. The full checklist is further down.
What are the biggest WordPress security events of 2026 so far?
Seven events matter most for site owners. Each one needed action within days, and some within hours.
| Date (2026) | Event | Identifier | Severity | Status |
|---|---|---|---|---|
| Jul 17 | wp2shell: core remote code execution via REST API batch route plus SQL injection | CVE-2026-63030, CVE-2026-60137 | CVSS 9.8 for the RCE chain (per CanSSOC) | Fixed in 6.8.6, 6.9.5, 7.0.2. Exploited in the wild |
| Sep 17 | WordPress 7.1.1 fixes 11 security issues | Multiple | Mixed | Fixed |
| Sep 22 | WordPress 7.1.2: unauthenticated path traversal in template loading | CVE-2026-87902 | CVSS 9.2 | Fixed. Probing began within hours (Patchstack) |
| Oct 6 | WordPress 7.1.3: 7 security fixes, including a second-order SQL injection in WXR export | Multiple | Mixed | Fixed |
| Oct 7–8 | Bricksforge Pro Forms: unauthenticated file upload leading to RCE | CVE-2026-85097 | CVSS 10.0 | Actively exploited. Fixed in 4.0.1 |
| Oct 17–19 | TeamUpdraft breach: stolen UpdraftCentral keys used to install backdoor plugins | No CVE | n/a | Delete keys, update to 1.26.13 / 2.26.13 |
| Oct 21 | PHP2Shell: two critical PHP flaws | CVE-2026-109618, CVE-2026-109619 | CVSS 9.2 each | Fixed in PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 |
A quick glossary helps here. A CVE is the public ID for a vulnerability. CVSS is its 0–10 severity score. RCE (remote code execution) means an attacker runs their own code on your server.
What is wp2shell, and was my site affected?
wp2shell is a chain of two WordPress core bugs that let an anonymous visitor take over a default install. No plugins, no login, no user interaction. WordPress published fixes on July 17, 2026 and pushed forced automatic updates, according to Rapid7.
The chain joins CVE-2026-63030, a REST API batch-route confusion bug introduced in WordPress 6.9, with CVE-2026-60137, a SQL injection in the author__not_in parameter of WP_Query. The full chain affects 6.9.0–6.9.4 and 7.0.0–7.0.1. Versions 6.8.0–6.8.5 carry only the SQL injection. The fixed releases are 6.8.6, 6.9.5 and 7.0.2.
Searchlight Cyber found the flaws, and Wiz reports that an AI model helped with the discovery. Public exploit code followed within a day, per BleepingComputer. Wiz then saw real attacks, including a 150KB webshell disguised as a plugin called “CMSmap”.
Were you affected? If your site auto-updates and runs a current version, you were probably patched in time. Confirm the version under Dashboard → Updates, then search your logs for user agents containing “wp2shell”, as CanSSOC advises. Unknown plugins you never installed are a red flag.
[ADD REAL EXPERIENCE HERE: for example, what you saw when scanning sites after the July disclosure.]
Why did WordPress ship three security releases in three weeks?
Because each one fixed something attackers could use. Skipping a point release is a real risk this year.
- 7.1.1 (Sept 17): 11 security issues, covering cross-site scripting (XSS), access control, path traversal and information disclosure.
- 7.1.2 (Sept 22): a critical flaw, CVE-2026-87902, rated CVSS 9.2. WordPress built a template file name from part of the URL without checking for
../steps. An attacker with no account could make a site load a local PHP file, which can lead to code execution on some servers, as The Hacker News explained. Fixes went back to branch 4.7. A site updated to 7.1.1 five days earlier still needed this one. - 7.1.3 (Oct 6): 7 security fixes and 4 bug fixes, including a second-order SQL injection in the WXR export feature.
Patchstack reported that attackers started probing for CVE-2026-87902 hours after the patch went public. WordPress also reminds everyone that only the newest version is actively supported.
What is PHP2Shell, and do I need to do anything?
Yes, but the fix probably sits with your host. On October 21, 2026, PHP released emergency updates for two critical flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2. They can allow unauthenticated remote code execution. The flaws are in PHP itself, so WordPress.org says no WordPress update is needed.
The fixed PHP versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. To check yours, go to Tools → Site Health → Info → Server. Be careful, though: some Linux distributions and hosts backport the fix without changing the version number, so an old-looking number does not always mean you are exposed. Ask your host directly.
Who acts:
- Managed WordPress hosting: the host patches. Check its status page.
- Shared hosting: the host rolls it out. Ask for confirmation.
- VPS or self-managed server: you or your admin must update PHP and restart it today.
- PHP 8.1 or older: the PHP project no longer ships fixes. Move to 8.2 or newer, testing on a staging copy first.
Cloudflare’s firewall rules help as a temporary layer, but treat them as a bandage, not a cure.
What happened with Bricksforge and UpdraftCentral?
These two incidents show the two ways sites get taken over in 2026: a coding flaw, and a stolen key.
Bricksforge: a CVSS 10 upload bug
CVE-2026-85097 is an unauthenticated arbitrary file upload flaw in the Pro Forms feature of the Bricksforge plugin. It lets an attacker upload and run PHP code. Patchstack telemetry recorded the first exploitation attempts on October 7, a day before the October 8 advisory, according to CybelAngel. The Bricksforge changelog lists the fix in version 4.0.1. If you run Bricksforge, update now and check wp-content/uploads for files you do not recognize.
UpdraftCentral: stolen keys, no bug required
TeamUpdraft, the company behind UpdraftPlus, was breached on October 17–18. Attackers got customer data that included UpdraftCentral connection keys. Patchstack and Nethemba confirmed that attackers used valid keys to install backdoor plugins on connected sites, even on fully patched ones. BleepingComputer estimated up to 400,000 sites could be exposed, which is potential exposure, not confirmed victims.
The fix: log in to each site’s own dashboard (not through UpdraftCentral) and delete the keys under Settings → UpdraftPlus Backups → Advanced Tools → UpdraftCentral → Manage existing keys. Update UpdraftPlus to 1.26.13 or 2.26.13, review administrator accounts and installed plugins, change passwords, and restore a clean backup if anything looks wrong. Patchstack noted this was the second incident in this channel in five months, after CVE-2026-10795 in June.
A backdoor that rebuilds itself
On October 1, The Hacker News covered a WordPress infection that hides in at least eight places across files, the database and shared memory. Each location can recreate the others, and a system cron job redeploys it on schedule. Sucuri’s takeaway is blunt: a modern infection can be a system, not a file. Deleting one suspicious file is not a cleanup.
How big is the WordPress plugin problem in 2026?
Big, and growing. Patchstack’s State of WordPress Security in 2026 counted 11,334 new vulnerabilities in 2025, up 42% from 7,966 the year before. Plugins accounted for 91% and themes for 9%. WordPress core itself contributed very few.
Two more figures, reported by secondary sources that cite Patchstack data, show why timing matters:
- Roughly 46% of vulnerabilities had no developer patch when they were disclosed.
- The median time to first mass exploitation was about five hours.
On top of that, a Censys report cited by Cybernews found only 14% of publicly visible WordPress sites ran the latest security patch. That gap is exactly what attackers scan for.
My take: WordPress core is not the problem. The ecosystem around it is, and the habit of installing a plugin for every small feature and never looking at it again.
Why does this matter if you build with AI tools and quick deployments?
Because the same patterns repeat. AI-assisted coding makes it easy to add a custom plugin, snippet or integration in minutes. In our experience, those quick additions often hardcode API keys, skip capability and nonce checks, and return more data than they should. [ADD REAL EXPERIENCE HERE: examples from your own scans.]
The UpdraftCentral case is the lesson. A leaked key did the same damage as a code bug. If a key sits in a public repo, a wp-config.php backup file or a plugin settings export, it can be found and used. Our guides on secret scanning, what to do when an API key is exposed and vibe coding security risks cover the details. Attackers also use AI now. The wp2shell discovery shows how fast the gap between “bug found” and “bug exploited” can close.
What should you do this week?
Work through this list in order. Most items take minutes.
| Step | Action | Threat it addresses |
|---|---|---|
| 1 | Check your PHP version (Site Health → Info → Server) and ask your host about the October 21 fix | PHP2Shell |
| 2 | Update WordPress core to the latest release (7.1.3 was current on Oct 6; check for newer) | wp2shell, CVE-2026-87902, 7.1.3 fixes |
| 3 | Update or delete plugins. Remove anything inactive. Update Bricksforge to 4.0.1 or later if you use it | Plugin flaws, CVE-2026-85097 |
| 4 | Delete UpdraftCentral keys, update UpdraftPlus, audit admin users and installed plugins | Stolen-key backdoors |
| 5 | Rotate secrets if you suspect exposure: admin passwords, database password, security salts in wp-config.php, third-party API keys | Credential theft |
| 6 | Turn on 2FA for all admins and limit who has administrator rights | Account takeover |
| 7 | Keep tested, off-site backups, and use a WordPress-aware firewall (WAF) or hosting protection | Fast exploitation, cleanup |
| 8 | Scan regularly for exposed keys, open endpoints and data leaks | Leaked secrets, misconfigurations |
For step 8, you can scan your app free with PrivacyReport’s App Security Scanner or use the Privacy Leak Detector to check for exposed user data. To catch new issues between reviews, Continuous Monitoring keeps watching. To be clear, these tools check your app for leaked keys and misconfigurations. They do not replace a WordPress security plugin or firewall. If you build with AI tools, see AI App Security.
Where can you follow reliable WordPress security news?
Start with primary sources: the WordPress.org News and Security pages, the NVD CVE database, and vulnerability trackers such as Patchstack, Wordfence, WPScan and Sucuri. For breaking incidents, BleepingComputer, The Hacker News and WP Tavern usually cover them within a day. We update this page monthly.
Frequently asked questions
Is WordPress still safe in 2026? Yes, if you keep it patched. Core has very few vulnerabilities, but July’s wp2shell chain showed that even core can be hit. Most risk comes from plugins, outdated installs and stolen credentials, which updates, fewer plugins and good key hygiene reduce.
What is wp2shell? wp2shell is the nickname for two WordPress core bugs, CVE-2026-63030 and CVE-2026-60137, chained for unauthenticated remote code execution. It affected 6.9.x and 7.0.x versions before 6.9.5 and 7.0.2, and was fixed on July 17, 2026.
Do I need to update PHP because of PHP2Shell? Yes, unless your host already did. The flaws, CVE-2026-109618 and CVE-2026-109619, are in PHP, not WordPress. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Managed hosts usually patch for you.
What is the most common cause of WordPress hacks? Vulnerable plugins and themes. Patchstack found 91% of new 2025 vulnerabilities in plugins and 9% in themes. Weak or stolen credentials and outdated PHP or core versions are the other big causes.
How often should I update plugins? Check at least weekly, and update critical security fixes within a day or two. Attackers have been exploiting serious plugin bugs within hours of disclosure. Turn on auto-updates for trusted plugins and delete the ones you do not use.
Do I need a security plugin? Usually yes, in some form. A WordPress-aware firewall or monitoring service catches attacks that generic hosting protection can miss. It does not replace updates, backups, 2FA and careful key handling.
What should I do if I used UpdraftCentral? Log in directly to each site and delete the UpdraftCentral connection keys, update UpdraftPlus to 1.26.13 or 2.26.13, review administrator accounts and plugins, change passwords, and restore a clean backup if you find anything suspicious.
Bottom line
WordPress security news 2026 comes down to one lesson: the gap between disclosure and attack is now measured in hours, and some attacks need no bug at all. Update PHP and core, trim your plugins, delete stale keys, and watch for new issues. If you want a second pair of eyes, run a free PrivacyReport scan on your app or repo.
Sources
- WordPress.org News: WordPress 7.1.3 Maintenance and Security Release (Oct 6, 2026)
- The Hacker News: WordPress Issues Patch for Critical Flaw (Sept 22, 2026)
- The Hacker News: WordPress Backdoor Rebuilds Itself (Oct 1, 2026)
- The Hacker News: Attackers abuse UpdraftCentral keys (Oct 2026)
- Patchstack: Stolen UpdraftCentral Keys Are Backdooring WordPress Sites
- Patchstack: State of WordPress Security in 2026
- Wiz Research: Exploitation in the Wild of wp2shell
- Rapid7: CVE-2026-63030 wp2shell
- BleepingComputer: wp2shell flaws get public exploits (Jul 18, 2026)
- CanSSOC advisory: wp2shell critical exploit chain (Jul 24, 2026)
- Codeable: PHP Security Release on 21 October 2026
- Cybernews: WordPress websites at risk from severe PHP flaws
- CybelAngel: CVE-2026-85097 Bricksforge exploitation
- SOCRadar: Bricksforge CVE-2026-85097
Hussian riaz is content lead aat privacyreport speclialized in vibe coding securit