Millions of WordPress Websites Face New Security Threats
A recent security incident involving a client’s WordPress website prompted our team at Digital Marketing Concepts to investigate a wave of newly disclosed WordPress vulnerabilities.
The compromised website contained malicious code associated with an “evil” file or component that appeared to have entered through a plugin. While a complete forensic investigation would be required to identify the exact point of entry, the incident occurred during a period of heightened attacks against WordPress core installations and several widely used plugins.
This is not an isolated concern. Security researchers have recently disclosed multiple vulnerabilities capable of allowing attackers to upload malicious files, execute code, create unauthorized accounts, access databases, and potentially take complete control of WordPress websites.
WordPress Core “wp2shell” Vulnerabilities
Two vulnerabilities identified as CVE-2026-60137 and CVE-2026-63030 were discovered in WordPress core and became collectively known as “wp2shell.”
The vulnerabilities involved a SQL injection weakness and a REST API batch-route confusion issue. When chained together, they could allow an attacker to execute code remotely without first signing into the affected website.
In practical terms, a successful attacker could potentially:
- Access information stored in the WordPress database
- Create unauthorized administrator accounts
- Install malicious plugins or webshells
- Redirect website visitors
- Steal customer or website information
- Use the compromised website to distribute malware or launch additional attacks
The affected versions included WordPress 6.9 releases before 6.9.5 and WordPress 7.0 releases before 7.0.2. Website owners running an affected version should immediately update to a patched release.
The vulnerability chain and affected versions have been documented by the National Vulnerability Database and security researchers at Akamai.
All-in-One WP Migration and Backup Vulnerability
A separate high-severity vulnerability was discovered in the popular All-in-One WP Migration and Backup plugin, which is installed on millions of WordPress websites.
The vulnerability, CVE-2026-19949, affected plugin versions through 7.109 and was corrected in version 7.110.
According to Wordfence, the vulnerability could allow an unauthenticated attacker to plant malicious information through WordPress trackbacks. That information could later be converted into executable database instructions when a website administrator exported and restored an archive.
Under the necessary conditions, an attacker could obtain the plugin’s secret import key and use it to deploy a malicious WordPress plugin, resulting in remote code execution and potentially a complete website takeover.
It is important to understand that this attack involved a series of conditions. The malicious payload would not execute merely because the vulnerable plugin was installed. An administrator would generally have to perform an export and subsequent import after the malicious data had been planted.
Nevertheless, the potential consequences were serious enough that every website using this plugin should be updated to version 7.110 or later. Additional technical details are available in the Wordfence security advisory.
Elementor Pro Vulnerability Under Active Attack
Security researchers have also reported active exploitation of a critical vulnerability in Elementor Pro, one of the most widely used WordPress page-building plugins.
CVE-2026-32475 affected Elementor Pro versions through 4.2.1 and received a critical severity rating.
The vulnerability involved improper validation of files uploaded through an Elementor Pro form. An unauthenticated attacker could potentially upload an executable PHP file when the targeted website had a published Elementor Pro form containing at least one non-required file-upload field.
Once uploaded, the malicious file could allow an attacker to execute commands, install a backdoor, or take control of the website.
The vulnerability was patched in Elementor Pro 4.2.2. Wordfence subsequently reported large numbers of attempts to exploit websites that had not yet been updated. Website owners using Elementor Pro should confirm that they are running version 4.2.2 or a later secure release.
More information is available in the Wordfence Elementor Pro advisory.
Super Forms Websites Were Also Targeted
A similar unrestricted-file-upload vulnerability was identified in Super Forms – Drag & Drop Form Builder.
CVE-2026-14894 affected versions through 6.3.313. The vulnerability could allow an unauthenticated visitor to obtain a required security token and upload a dangerous file without adequate file-type or user-permission verification.
Security researchers observed extensive attempts to exploit the Elementor Pro and Super Forms vulnerabilities. Wordfence reported blocking more than 440,000 related exploit attempts, demonstrating how quickly criminals begin scanning the internet after a vulnerability becomes publicly known.
The Super Forms vulnerability has been patched, and users should immediately install the latest secure version. Details are available in the Wordfence Super Forms security report.
Updating WordPress Is Essential—but It Is Not Enough
Many business owners assume that their website is protected as long as WordPress updates automatically. Unfortunately, WordPress security involves several separate components:
- WordPress core
- Themes
- Plugins
- Hosting and server software
- Administrator accounts
- Passwords and authentication
- Backups
- Firewall and malware-monitoring systems
Updating WordPress core does not automatically correct every vulnerable plugin. Likewise, updating a plugin does not remove a backdoor that may have been installed before the update.
If a website was already compromised, installing the latest version may close the original entry point while leaving malicious files, unauthorized users, scheduled tasks, or altered database records behind.
What WordPress Website Owners Should Do Now
Digital Marketing Concepts recommends that businesses take the following precautions:
- Update WordPress core, active themes, and all plugins.
- Remove unused plugins and themes instead of leaving them installed.
- Verify that premium plugins receive legitimate updates and have valid licenses.
- Review all WordPress administrator accounts for unauthorized users.
- Change WordPress, hosting, database, FTP, cPanel, and related passwords after a compromise.
- Enable multifactor authentication for administrator accounts.
- Scan the entire website and hosting account for malicious or recently modified files.
- Review server access logs whenever possible.
- Install a properly configured website firewall.
- Maintain clean, off-site backups that predate any known compromise.
- Check other websites hosted under the same account because malware may spread between installations.
- Continue monitoring the website after cleanup for reinfection or newly created files.
A Website Is a Business Asset — and It Requires Ongoing Protection
WordPress remains an extremely capable website platform, but its popularity makes it a constant target. Attackers routinely scan millions of websites for vulnerable software and may begin exploiting a newly announced weakness within hours or days.
The recent WordPress core, Elementor Pro, Super Forms, and All-in-One WP Migration vulnerabilities demonstrate why website security cannot be treated as a one-time installation task. Regular maintenance, rapid security updates, malware monitoring, reliable backups, and professional review are now essential parts of operating a business website.
If you are concerned that your WordPress website may be vulnerable or already compromised, Digital Marketing Concepts can help evaluate the installation, identify suspicious activity, update vulnerable components, and develop an ongoing website maintenance and security plan.
