Thousands of WordPress vulnerabilities are published every year, but only a small share is attacked in practice. A Q3 2026 roundup published by Professional IT Services on October 20 looks at the ones that were. Here is a short summary, together with what it means for an ordinary business site. The details come from that report, so check the vendor pages for your own plugins.
What was exploited
- WordPress core: two linked flaws nicknamed “wp2shell” (CVE-2026-60137 and CVE-2026-63030), fixed in WordPress 7.0.2, 6.9.5 and 6.8.6 on July 17. Another core path-traversal flaw (CVE-2026-87902) was fixed on September 22.
- Elementor Pro up to 4.2.1: an unauthenticated file-upload flaw (CVE-2026-32475) fixed in 4.2.2 on August 19, with attacks starting on the release day.
- WooCommerce Wholesale Lead Capture up to 2.0.3.1: a flaw (CVE-2026-27540) fixed in 2.0.3.2 on February 20 and still attacked between June and August.
Just after the quarter ended, attacks continued. Stored cross-site scripting flaws in Ninja Forms up to 3.15.3 and WPC Product Bundles up to 8.6.6 were exploited from October 4, and in October attackers also abused stolen UpdraftCentral keys. There is no code fix for the stolen keys, so the advice is to delete them and create new ones.
What this teaches us
- Attackers move fast. Some flaws were attacked on the very day the fix came out, so waiting a month to update is a real risk.
- Old fixes still matter. A flaw fixed in February was still being used in the summer because many sites never updated.
- File upload and form plugins are repeat targets.
- Page builders and form plugins are installed on millions of sites, which makes them attractive.
- Keys and tokens count as passwords. Treat remote-management keys and API tokens like admin accounts.
The practical routine is not complicated: turn on automatic security updates for core, patch exploited plugins the same day, and review everything else in a monthly maintenance window.
Frequently asked questions
Does an old vulnerability still matter if I updated recently?
Updating closes the hole, but if the site was attacked before the update, a backdoor may remain. After a big incident, check for unknown admins and files.
How can I see if my plugins have known vulnerabilities?
Use a vulnerability database or a security plugin that checks versions, and compare your installed versions with the changelogs.
Should I stop using page builders?
No. Well-maintained builders are fine. Just keep them updated and avoid stacking many overlapping add-ons.
Read next
- WordPress Updates, Backups and Vulnerability Monitoring: A Simple Routine
- Bricksforge Plugin Vulnerability: What Happened and How to Fix It
- Essential WordPress Plugins for a Business Website
Need help keeping your WordPress site secure? We offer maintenance, updates and security checks. Contact us
