// stack
WordPress
Security incidents affecting wordPress core, plugins and WordPress hosting. Newest first.
- incidents
- 5
- live
- 0
- patched
- 4
## 5 WordPress incidents in the last year
through Oct 22, 2026- highclosedpartial fixclosed Oct 20, 2026
TeamUpdraft / UpdraftCentral keys stolen; WordPress sites backdoored
› UpdraftPlus / UpdraftCentral (WordPress)
UK plugin maker TeamUpdraft said attackers breached its website, stole UpdraftCentral connection keys, and used them to backdoor WordPress sites running UpdraftPlus/UpdraftCentral.
- criticalclosedpatchedclosed Oct 16, 2026
Rank Math PRO WordPress plugin download backdoored
› Rank Math PRO (WordPress)
SEO plugin vendor Rank Math confirmed attackers tampered with PRO version 3.0.123 on the official download site, planting hidden backdoors during an ~11-hour window. Sites that installed that build should audit and rebuild.
highWordPress Core: WordPress Core Remote File Inclusion Vulnerabilitypatched
› WordPress Core patched
WordPress Core contains a remote file inclusion vulnerability which could allow an unauthenticated attacker to make page-template resolution include a chosen readable local `.php` file outside the active theme directories, leading to remote code execution. Added to CISA KEV on 2026-09-25.
open incident →CVE-2026-87902
show 2 older incidents2 older incidents
July 2026 1
highWordPress Core: WordPress Core SQL Injection Vulnerabilitypatched
› WordPress Core patched
WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations. CISA added CVE-2026-60137, CVE-2026-63030 to the Known Exploited Vulnerabilities catalog on 2026-07-21 based on evidence of active exploitation.
open incident →CVE-2026-60137 · CVE-2026-63030
April 2026 1
highWebPros cPanel & WHM and WP2 (WordPress Squared): WebPros cPanel & WHM and WP2 (WordPress Squared) Missing Authentication for Critical Function Vulnerabilitypatched
› WebPros cPanel & WHM and WP2 (WordPress Squared) patched
WebPros cPanel & WHM (WebHost Manager) and WP2 (WordPress Squared) contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain unauthorized access to the control panel. Added to CISA KEV on 2026-04-30.
open incident →CVE-2026-41940
