# Critical WordPress Plugin Vulnerabilities Put Thousands of Websites at Risk
A severe security flaw in a popular WordPress plugin has been exploited by attackers in real-world attacks, putting countless websites at risk of being taken over completely. The vulnerability allows hackers to run their own malicious code on a website’s server without needing any login credentials — a scenario that every website owner dreads.
## What’s Happening?
Security researchers have identified a maximum-severity vulnerability in a widely used WordPress plugin that supports visual website building. The flaw carries the highest possible risk rating, meaning it can be exploited by anyone on the internet — even those who have never set foot in the site’s admin area.
The bug lies in how the plugin handles file uploads during form submissions. While the plugin does check the type of files being uploaded, it fails to verify the destination path where those files are ultimately stored. This creates a gap that attackers can exploit by sneaking in malicious code disguised as an image file.
## How Do Attackers Exploit It?
The attack unfolds in a few deceptively simple steps:
1. **Getting a Access Key**: The attacker first requests a special access token from an unprotected part of the plugin, no login required.
2. **Uploading a Trap File**: The attacker sends a file that looks like a normal image (such as a GIF) but secretly contains executable code hidden inside. Because the initial upload checks the file type, this disguised file passes through undetected.
3. **Rewriting the Path**: The attacker then submits a crafted form that tells the server to save the trapped file with a code-execution extension (like .php) instead of keeping it as an image.
4. **Code Runs Automatically**: When someone visits the crafted file path on the website, the hidden code executes on the server, giving the attacker full control.
To avoid detection and bypass basic security filters, attackers have been using tricky naming tricks — changing file extensions to different variations like `.php5`, `.phtml`, or even encoding the extension in ways that web servers still recognize as executable.
## Who Is Behind the Attacks?
Security teams monitoring the situation have observed activity from over 60 unique internet addresses. The attacks show clear signs of automation, with batches of requests fired off in rapid succession from different locations, suggesting the use of networks of compromised devices to mask the attackers’ true identities.
Six specific internet addresses were responsible for a large share of the malicious traffic, indicating focused and organized activity rather than random probing.
## The Damage Potential
If successfully exploited, this vulnerability can lead to complete takeover of a website. An attacker could install hidden backdoors, steal sensitive visitor data, create secret administrator accounts, or use the website to attack other targets.
## What Should Website Owners Do?
– **Update immediately** to the latest version of the plugin, which contains a fix for this issue.
– **Monitor file upload directories** for any unexpected or suspicious files.
– **Review access logs** for unusual POST requests to the form submission areas of the plugin.
– **Install a web application firewall** to help block malicious traffic before it reaches the site.
## A Broader Pattern of Attacks
This vulnerability comes at a time when WordPress security threats are surging. In the second quarter of 2026 alone, over 2,000 security flaws in WordPress-related plugins and software were reported. Approximately 573,000 websites were compromised during that period.
The most targeted vulnerabilities in the quarter included flaws in caching plugins, GraphQL tools, file management plugins, and payment processing extensions — all carrying high risk scores. Attackers were mainly originating from the United States, Germany, Czechia, Australia, and several European and South American countries.
Additionally, separate attacks targeting two other WordPress plugins involved the deployment of malicious JavaScript code designed to create hidden admin accounts and install backdoor plugins that persist even after updates.
## Frequently Asked Questions
**What does this vulnerability allow attackers to do?**
Attackers can run any code they want on the web server, essentially taking complete control of the website without needing a username or password.
**Which version of the plugin is affected?**
All versions up to and including 3.1.8.9 are vulnerable. Users should upgrade to the latest patched version.
**Can regular visitors to a website be affected?**
While visitors themselves aren’t directly exploited, their data (such as personal information, login sessions, or financial details) could be stolen if the site is compromised. The website could also be used to spread malware to visitors.
**Does updating the plugin remove an existing infection?**
No. Updating only prevents future exploitation. If a site has already been compromised, a thorough security audit — including database checks, file reviews, and log analysis — is necessary to clean up the infection.
**Are non-WordPress websites affected?**
No. This vulnerability is specific to the WordPress plugin in question.
**How can I check if my site has been compromised?**
Look for unexpected administrator accounts, unfamiliar files in upload directories, unusual activity in your web server logs, and any unknown plugins that weren’t installed by you.
## Conclusion
The discovery of this critical vulnerability highlights the importance of keeping WordPress plugins and all website software up to date. In today’s landscape, where thousands of security flaws are discovered every quarter and automated attacks are commonplace, proactive security measures — timely updates, web application firewalls, regular scanning, and log monitoring — are not optional but essential. Website owners who act quickly to patch vulnerabilities can protect themselves from becoming the next victim of a takeover attack. Stay vigilant, stay updated, and keep your digital properties secure.
Thank you for reading
