GetOffWP Check my site

GetOffWP · Articles

Article · 22 Oct 2026

4 WordPress Plugin Hacks in 8 Weeks: What Happened and What to Do Now

Rank Math PRO shipped malware. Bricksforge and Elementor Pro let strangers run code on your server. All-in-One WP Migration turned a backup into a takeover. Here's what happened, how to check your site, and the pattern behind all four.

Updated 23 Oct 2026

Four plugin cartridges on a shelf; one orange cartridge is cracked open with pixel fragments escaping.

If you run a WordPress site, the last two months were rough.

Between late August and mid-October, four popular plugins had serious security problems. One shipped malware through its own update channel. Two let strangers upload code to your server and run it, no login needed. One turned a routine backup into a way to take over the site.

Every one of them has a fix. But if you only patch and move on, you miss the bigger story. This post covers what happened, what to do if you use these plugins, and what the pattern says about running a simple site on WordPress.

The short version

Plugin What went wrong Fixed in Attacked in the wild? Rank Math PRO Malware shipped inside an official update (Oct 15–16) 3.0.124 Delivered directly to customers Bricksforge Anyone could upload and run PHP, no login 3.1.8.10 / 4.0.1 Yes, since Oct 7 Elementor Pro Form file uploads let attackers drop a PHP file 4.2.2 Yes, since early September All-in-One WP Migration Hidden SQL injection that fires during a restore 7.110 Proof of concept public

1. Rank Math PRO: the update was the attack

This is the one that should worry you most.

For about 11 hours, from 20:02 UTC on October 15 to 07:12 UTC on October 16, some copies of Rank Math PRO 3.0.123 contained malware. Sites got it the normal way: by downloading or auto-updating the plugin. Rank Math pulled the files and released a clean 3.0.124.

Wordfence rated it 9.8 out of 10 (critical), tracked as CVE-2026-111862. Only the paid PRO add-on was affected, not the free Rank Math plugin from WordPress.org.

Here's the part that matters. Updating to 3.0.124 does not clean your site. The malware can leave behind extra files, rogue admin accounts and scheduled tasks. Rank Math says passwords, database credentials and API keys the server could read may be exposed.

What to do:

  • Check when your site got 3.0.123. If it was before 20:02 UTC on October 15, you're fine. Just update normally.
  • If it arrived inside the window but you never activated it, delete the plugin folder, install 3.0.124 from your Rank Math account, and run a malware scan.
  • If an affected copy was activated, treat the site as compromised. Rank Math recommends restoring files and database from a backup taken before 20:02 UTC on October 15. Then change every password and rotate every API key the site touches.

2. Bricksforge: run any code, no login needed

Bricksforge is a paid add-on for the Bricks page builder. It adds forms, animations and other extras.

Versions up to 3.1.8.9 had a flaw (CVE-2026-85097) that let anyone upload a PHP file and run it. Patchstack rated it 10.0, the maximum. The trick was simple: upload a file that looks like an image but contains PHP. Bricksforge checked the file type once at upload, then trusted the attacker's details when the form was submitted and saved the file as PHP.

Patchstack saw the first attacks on October 7, the day before the public advisory. So there was no safe window between "announced" and "attacked."

What to do:

  • Update to 3.1.8.10, or 4.0.1 on the newer branch.
  • Look in /wp-content/uploads/bricksforge/tmp/ for any .php files. There should be none.
  • If you find one, assume someone ran code on your server and follow a full cleanup.

3. Elementor Pro: a file upload field that let PHP through

Elementor Pro had a similar problem in its Forms widget (CVE-2026-32475). By sending an empty file first and a PHP file second, an attacker could skip the checks and write a PHP file into /wp-content/uploads/elementor/forms/.

Elementor fixed it in 4.2.2 on August 19. Attacks started in early September. Wordfence says its firewall had already blocked more than 190,000 attempts.

One piece of good news: Elementor says the attack only works on forms with a File Upload field that allows multiple files. That option is off by default.

What to do:

  • Update to Elementor Pro 4.2.2 or later.
  • Check /wp-content/uploads/elementor/forms/ for unexpected PHP files.
  • Remove file upload fields from any form that doesn't need one.

4. All-in-One WP Migration: backup day becomes attack day

All-in-One WP Migration and Backup runs on more than 5 million sites. Versions up to 7.109 had a sneaky flaw (CVE-2026-19949, rated 8.8).

An attacker didn't need to log in. They could plant bad data through public inputs like trackbacks, then wait. The next time an admin ran an export or restore, the plugin processed that data and leaked its secret key. With the key, the attacker could import a crafted archive and take over the site.

ServMask fixed it in 7.110 on August 20. Public reports show a proof of concept but no confirmed attacks yet. A second, smaller flaw (CVE-2026-81810) was fixed in 7.111.

What to do:

  • Update to 7.111 or later.
  • If you only use it once a year for a move, consider removing it between uses.

The pattern behind all four

Look past the plugin names and the same few things keep showing up.

A file lands on your server, and PHP runs it. Three of the four come down to this. WordPress runs PHP, and PHP will run a .php file wherever it ends up, including the uploads folder. A form, a backup import, a plugin update: any path that can put a file on the server is a path to running code on it.

"Keep everything updated" was the infection route. The standard advice is to update fast. With Rank Math, the people who updated fastest got the malware. Supply-chain attacks flip the advice on its head, and there's no setting that protects you from a plugin vendor getting hacked.

Every plugin is someone else's code with full access. Most sites run a long list of plugins. Each one can read your database and your secrets. Each vendor has its own security team, or doesn't. Your site is as safe as the weakest one.

Patching doesn't undo damage. Once someone has run code on the server, the fix closes the door but leaves whatever they left behind. Real cleanup means backups, file audits and rotating every credential. That's hours of work, often for a site that's mostly blog posts.

Should you leave WordPress?

Not everyone should. Be honest about what your site does.

Stay on WordPress if:

  • You run WooCommerce, memberships or anything with logins and payments built deep into WordPress.
  • Someone checks plugins and security every week, and it's part of their job.
  • You rely on plugins that have no real replacement elsewhere.

Think about leaving if:

  • Your site is mostly a blog plus a handful of pages.
  • Nobody really watches it. Updates happen when someone remembers.
  • You're paying for page builders, SEO plugins and security plugins mostly to keep the site standing.
  • You read this post and weren't sure whether you're affected.

A content site doesn't need a PHP server running in the background. Pages can be built ahead of time and served from a global network, with no uploads folder that runs code and no plugin updates pulling third-party code onto your server. That doesn't make a site unhackable. You still need strong passwords and a careful editor setup. But it removes the whole class of problems in this post.

Where GetOffWP fits

This is the reason GetOffWP exists.

I move WordPress content sites off WordPress for a flat fee. Your posts, images and URLs come across. Your site gets rebuilt as code you own, running on Cloudflare Workers, with the code in your own GitHub. You write and edit in Nanoblog, an editor I built, so publishing stays as easy as it was.

The promise is simple: live in 48 hours, faster on PageSpeed than your current site, redirects fixed free for 90 days, and a 30-day rollback if you change your mind.

If your site is mostly content and the last two months made you nervous, check whether your site is a fit.

— Michal Hlavacek

Sources

← All articles