Seven times this year, WordPress sites were hacked through something their owners trusted: an official plugin update, a script loaded from the plugin maker’s servers, or a connected backup service. Here is every incident, who was affected and what to check.
Last updated 30 October 2026 · 7 incidents · Maintained by the Moatline team
How they got in
Three ways a trusted plugin turns against you
The vendor was hacked
Their build system, update server or script CDN was changed, so the real update or script carried the attack. Rank Math PRO 3.0.123, OptinMonster, TrustPulse and PushEngage scripts, ShapedPlugin Pro plugins.
The author was the attacker
A plugin changed hands, or its author added a hidden channel, and used the trust of an existing install base. Quick Page/Post Redirect, 31 Essential Plugin plugins.
Remote-management keys were stolen
A service allowed to install plugins on your site was breached, and its keys were used to install backdoors. UpdraftCentral keys stolen.
What they have in common: WordPress itself installs the backdoor, through a normal update or a signed command, so firewalls and two-factor login don’t stop it. And updating to the fixed version rarely removes what was already installed.
Timeline
Every incident, newest first
18–19 October 2026
UpdraftCentral keys stolen Remote-management keys were stolen
Attackers broke into TeamUpdraft (the makers of UpdraftPlus) and used stolen UpdraftCentral connection keys to install backdoor plugins on connected sites through WordPress’s normal installer. The backdoor added a hidden account with the power to install plugins.
Who was affected
Sites with UpdraftPlus connected to UpdraftCentral Cloud.
What to do
Update UpdraftPlus to 1.26.13 or newer, delete your UpdraftCentral keys if you don’t use it, remove unknown plugins and accounts.
For about 11 hours, the official Rank Math PRO update contained a backdoor that rebuilt itself on page visits and could expose database and API credentials.
Who was affected
Sites that installed and activated Rank Math PRO 3.0.123 during that window. The free Rank Math SEO plugin was not affected.
What to do
Delete the plugin folder, install 3.0.124 or newer, then clean up and change every password and key.
Advanced Responsive Video Embedder 10.8.7 A backdoored release
A release contained a hidden file that logged anyone with a secret token in as an administrator and reported the site to an outside server. Wordfence spotted it within two hours and WordPress.org pulled it.
Who was affected
Sites that installed versions 10.8.7 or 10.8.8 (CVE-2026-18072).
What to do
Update to 10.9.0 or newer, then check for administrators you didn’t create and change all passwords.
OptinMonster, TrustPulse and PushEngage scripts The vendor was hacked
Attackers changed the JavaScript these services load from their own servers. When a signed-in administrator opened a page, the script created a new administrator (such as developer_api1) and installed a hidden plugin called “Content Delivery Helper” or “Database Optimizer” with a web shell.
Who was affected
Sites with one of the three plugins active from 12 to 14 June, if an administrator browsed the site while signed in. About 1.2 million sites run them.
What to do
Look for those plugin folders and for administrators you didn’t create, then change passwords and the wp-config.php keys.
Malicious code was slipped into the vendor’s build process on 21 May, so official Pro updates installed a loader that downloaded a hidden plugin with a file manager, a database tool and a login bypass (CVE-2026-10735).
Who was affected
Product Slider Pro for WooCommerce before 3.5.4, Real Testimonials Pro 3.2.5 and Smart Post Show Pro before 4.0.2.
What to do
Update to a clean version, then delete the hidden plugin. Updating alone doesn’t remove it.
Quick Page/Post Redirect The author was the attacker
The plugin’s own author had added an update channel to his own server, outside WordPress.org. In 2021 it delivered a tampered version that showed spam to logged-out visitors, and it could deliver new code at any time. WordPress.org closed the plugin on 14 April 2026.
Who was affected
More than 70,000 sites used it.
What to do
Delete the plugin and use another redirect plugin, then check posts and pages for spam links.
31 Essential Plugin plugins The author was the attacker
Someone bought a family of small plugins and later added a backdoor. On 5–6 April it wrote hidden spam code into wp-config.php. WordPress.org closed all 31 plugins and switched the backdoor off, but couldn’t remove what was already written.
Who was affected
Sites with any of the 31 plugins by “Essential Plugin” (formerly WP OnlineSupport).
What to do
Delete the plugins and clean wp-config.php. The WordPress.org notice stays until you do.
Since 5 June, every plugin and theme release on WordPress.org waits six hours before it reaches sites. Since 9 September, that wait is used for an automated security review, and risky releases are blocked. On 28 July the review caught a backdoor committed to a plugin with about 20,000 installs before it was sent to a single site.
Every incident above ended with a plugin, an account or a file appearing on the site. An email the moment that happens turns days into minutes.
Lock installs you don’t expect
A site lock blocks new plugins and administrators even when the request comes from a trusted service or a signed-in browser. Updates keep running.
Disconnect what you don’t use
Remote-management keys (UpdraftCentral, ManageWP, MainWP and similar) can install plugins. Delete the ones you don’t actively use.
Treat closed plugins as a warning
WordPress.org closes plugins for security reasons. If one you use is closed, replace it rather than waiting.
Don’t stop at the update
After any incident, look for what the backdoor left: hidden plugins, new administrators, files in mu-plugins and code in wp-config.php.
Keep off-site backups
A clean backup from before the incident is often the fastest way back, followed by new passwords and keys.
Moatline watches for all of this
The free plugin emails you when a plugin is installed, can lock installs with one click, detects every backdoor on this page and checks your plugins against our list of plugins under attack twice a day.
An attack that arrives through something you already trust: a plugin update, a script your plugin loads from its maker’s servers, or a service you connected to your site. Your site does exactly what it is told, so firewalls and login protection don’t see anything wrong.
Should I turn off automatic updates?
No. Most hacks still come through outdated plugins with known holes, and automatic updates close those fast. WordPress.org now holds every plugin release for six hours and checks it before it goes out. For premium plugins, which don’t get that check, waiting a day before updating is reasonable.
Does a firewall stop these attacks?
Usually not. The backdoor is installed by WordPress itself, through a normal update or a signed command from a service you trust. What helps is noticing the install (an email when a plugin is installed), blocking installs you don’t expect (a site lock), and scanning for what a backdoor leaves behind.
I updated to the fixed version. Am I clean?
Not necessarily. In almost every case on this page, the backdoor installed something separate, such as a hidden plugin, an administrator account or code in wp-config.php, that the update doesn’t remove. Check for those, or run a scan.
How do I hear about the next one?
Install the free Moatline plugin. It checks your plugins against our list of plugins under attack twice a day and emails you, and since version 1.3.2 it also emails you when a plugin is installed or a must-use plugin appears.
We add an incident when the plugin maker, WordPress.org or a security research team has confirmed malicious code in a release, update channel or connected service. Sources are linked on each card.