WordPress Security Threats
The recent WordPress vulnerabilities worth knowing about, including the wp2shell core fix, each checked against its official advisory, plus the steps that actually reduce your risk.
Written by Adrian Chromenko
Co-founder & Web Developer at PrimaryDM
Adrian co-founded PrimaryDM in 2018 and works on the WordPress sites our team builds and maintains for clients. Every vulnerability on this page links to its advisory so you can check the details yourself. Last reviewed October 2026.
The WordPress Threat Landscape in Numbers
From Patchstack's State of WordPress Security in 2026 report, which covers vulnerabilities disclosed in 2025.
Outdated software is also common: in a July 2026 scan, Censys found that more than 70% of publicly reachable WordPress sites were running an end-of-life version of PHP. Source: Censys: WordPress sites running end-of-life PHP (July 2026).
Recent Vulnerabilities Worth Knowing About
Critical issues in WordPress core and widely used plugins from 2025 and 2026, most of them exploited in the wild. If you run any of these, check your version against the fixed release.
wp2shell (WordPress core)
What it is: Two core issues fixed together in the WordPress 7.0.2 security release: CVE-2026-63030, a critical flaw rated CVSS 9.8, and CVE-2026-60137, an SQL injection issue. WordPress.org enabled forced automatic updates for affected sites, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog.
Affected: WordPress 6.9.x and 7.0.x are affected by both issues; 6.8.x by one of them. Versions before 6.8 are not affected.
Burst Statistics authentication bypass
What it is: An authentication bypass (CVSS 9.8) that let attackers gain access without valid credentials. Attackers began exploiting it shortly after disclosure.
Affected: Burst Statistics 3.4.0 to 3.4.1.1
Breeze cache plugin file upload
What it is: An unauthenticated arbitrary file upload (CVSS 9.8) that could let an attacker place a malicious file on the server. It is only exploitable when the "Host Files Locally – Gravatars" setting is turned on, which it is not by default.
Affected: Breeze 2.4.4 and earlier
Everest Forms Pro code injection
What it is: An unauthenticated PHP code injection (CVSS 9.8) leading to remote code execution through form submissions.
Affected: Everest Forms Pro 1.9.12 and earlier
Post SMTP account takeover
What it is: An unauthenticated flaw (CVSS 9.8) that could lead to account takeover. Wordfence reported attackers actively exploiting it.
Affected: Post SMTP 3.6.0 and earlier
OttoKit (SureTriggers) privilege escalation
What it is: A privilege escalation flaw (CVSS 9.8) that let unauthenticated attackers connect to a site through the plugin under certain conditions. Wordfence observed attackers using it to create administrator accounts.
Affected: OttoKit 1.0.82 and earlier
How to Protect Your WordPress Site
Six measures that address how WordPress sites actually get compromised. For a fuller checklist, see our WordPress security best practices.
Keep WordPress core updated
Core vulnerabilities are rare, but when one lands it matters: wp2shell was serious enough for WordPress.org to force automatic updates. Leave minor and security auto-updates switched on, and check that they are actually running.
Update plugins and themes quickly
Patchstack found 91% of new WordPress vulnerabilities in 2025 were in plugins and a median of 5 hours to mass exploitation for the heavily exploited ones. Apply security updates as soon as they are released, not at the end of the month.
Remove what you don’t use
Patchstack reports 46% of vulnerabilities had no fix from the developer in time for public disclosure, so updating alone is not always enough. Every plugin you delete is one less thing to patch; deactivated plugins can still contain vulnerable files.
Use strong passwords and two-factor authentication
Use unique passwords from a password manager and turn on two-factor authentication for every administrator account. Give each person their own account with the lowest role they need.
Add application-level protection
In Patchstack’s own test of five hosting environments in 2025, attacks on 11 known plugin vulnerabilities got past the hosts’ existing security in 87.8% of cases. Patchstack sells a competing product, so treat that as one vendor’s test, but the lesson holds: a web application firewall or virtual patching that understands WordPress plugins adds a layer server firewalls usually lack.
Keep off-site backups and test a restore
Automated daily backups stored away from your server let you recover a compromised site to a known-good state. A backup you have never restored is a hope, not a plan.
Warning Signs Your Site May Be Hacked
- Put the site into maintenance mode
- Change every password: WordPress, hosting, FTP and database
- Restore from a clean backup if you have one
- Update WordPress, plugins and themes, and remove anything unused
- Scan for malware, or bring in someone who handles incident response
WordPress Security Questions Answered
Sources
- WordPress.org: WordPress 7.0.2 security release (July 17, 2026)
- CVE record: CVE-2026-63030
- CVE record: CVE-2026-60137
- CISA Known Exploited Vulnerabilities catalog
- Wordfence: Burst Statistics CVE-2026-8181
- BleepingComputer: Hackers exploit auth bypass flaw in Burst Statistics
- NVD: CVE-2026-3844 (Breeze)
- Wordfence: Everest Forms Pro CVE-2026-3300
- The Hacker News: Hackers exploit critical Everest Forms flaw
- Wordfence: Attackers actively exploiting critical vulnerability in Post SMTP
- The Hacker News: OttoKit WordPress plugin flaw exploited
- Patchstack: State of WordPress Security in 2026
- Patchstack: Hosting security tested (August 2025)
- Censys: WordPress sites running end-of-life PHP (July 2026)
Don't Wait Until You're Hacked
Our maintenance plans start at $149/month and cover updates, backups, monitoring and help when something goes wrong, so security fixes are applied when they are released, not weeks later.
Ready to Start Your Project?
Let's create something amazing together. Tell us about your project and we'll get back to you with a detailed proposal.
What happens next?
- 1.We'll review your project requirements
- 2.Schedule a discovery call within 24 hours
- 3.Provide a detailed proposal and timeline
- 4.Begin development with your approval