Updating regularly should keep your site secure, right?
But what happens when the vulnerability is in the update itself…
WordPress 7.1.4 has just been released, and researchers discovered a major vulnerability in the update process itself. Days earlier, malware was found in official RankMath Pro updates.
Throughout 2026, we have seen a rising trend of compromised updates leading to hacks, like with Smart Slider 3 Pro, Fluent Forms Pro, Ninja Tables Pro, and several other plugins.
And the other pattern is updates not being able to secure sites. Like last week, when UpdraftPlus released an update revoking stolen account keys, but fake admin accounts and plugins were still being created.
Basically, the writing is on the wall. Clicking update is no longer the saviour it used to be, and increasingly, might even put your site in danger.
📝 Note: If you’re a MalCare customer, you’re already protected. Vulnerability Shield released a new patch for WP 7.1.4 within hours. For RankMath & UpdraftPlus, our Malware Scanner was alerting sites of any suspicious plugins or file changes.
This is why at MalCare, we’ve been improving security beyond conventional methods and shipping new features almost every week. In September, this helped us block over 20 million attacks, up from 7 million the month before.
Some recent improvements are:
Preventing compromised updates: Adding safeguards to stop known malicious plugin versions from being installed.
Block attacks even when they use trusted connections: our firewall inspects sensitive WordPress actions too, including those coming through remote-management channels that most firewalls simply trust.
Continuously adapting to new attacks: Vulnerability Shield patches most vulnerabilities within minutes from its growing library of 20,000+ patches.
Detecting suspicious activity and files: with behavioral malware scans that detect suspicious activity, malicious plugins, sudden file changes, and other symptoms of unknown or new types of hacks
Making urgent fixes easier and faster: with features like Code Snippets Manager, which one of our customers used to rotate compromised UpdraftCentral keys across hundreds of sites.
What’s going on
I’ve been building MalCare since 2010, and seen WordPress go through many ups and downs.
Nothing comes close to what I’ve been seeing over the past few months. I’m not writing this to alarm anyone. I just want to help you understand how this affects your sites, and how to keep them protected.
We’re seeing a pattern of incidents that’s forcing us to rethink how we think of updates and security.
Date | Software | What happened |
October 2026 | WordPress Core 7.1.4 | A flaw let attackers run malicious code during the WordPress update itself, without needing to log in. Rated 9.0 out of 10. |
October 2026 | UpdraftPlus (UpdraftCentral) | Attackers used keys stolen from the vendor’s own systems to install backdoor plugins on connected sites. The update cuts off the old keys, but doesn’t remove backdoors already installed. |
October 2026 | Rank Math PRO | Official 3.0.123 downloads carried malware for 11 hours. It could leave hidden backdoors that stayed even after updating to the clean 3.0.124. |
September 2026 | Admin Menu Editor Pro | Attackers breached the developer’s own site and poisoned the official update twice in one day, including the “clean” replacement. Around 230 customers were hit with hidden web shells and users. |
July 2026 | Fluent Forms Pro & Ninja Tables Pro | Attackers got in through an old server the vendor forgot to shut down and tampered with official updates for five hours. Around 295 customers downloaded infected files, and the malware could stay even after updating. |
June 2026 | OptinMonster, TrustPulse & PushEngage | Attackers broke into the vendor’s content delivery network and tampered with scripts these plugins load. No update was needed. When an admin visited their own site, a rogue admin account could be created. |
June 2026 | Uncanny Automator Pro | Attackers compromised the official update server and pushed a backdoored version for nearly 22 hours. Reinstalling the plugin wasn’t enough to clean it. |
May–June 2026 | Real Testimonials Pro & Woo Product Slider Pro | Compromised premium updates delivered malware through official channels, installing fake plugins and persistent backdoors. |
April 2026 | Smart Slider 3 Pro | Attackers hijacked the official update system for six hours. The malicious version created hidden admins, installed backdoors and restored deleted malware automatically. |
April 2026 | EssentialPlugin (31 plugins) | Attackers bought the plugin company and shipped a backdoor inside a routine-looking update. It sat dormant for months, then switched on and planted malware that stayed even after the plugins were removed. |
The three main patterns are:
1) The update is how attackers are getting in. With Rank Math, Smart Slider 3, and Fluent Forms, hackers managed to distribute malware through the official plugin update system. Website owners who promptly installed those updates were unknowingly putting their sites at risk. And in the Admin Menu Editor incident, even the first clean replacement was compromised again on the same day.
2) Hackers piggyback the vendor connections. Fluent was breached through an old server it forgot to switch off. Admin Menu Editor was breached through the developer’s own website. UpdraftCentral keys were stolen from TeamUpdraft’s systems. Your site did everything right and trusted the right source. A normal update only confirms the file came from the vendor’s server, not that the vendor built it, and a firewall can’t stop code you yourself invited in.
3) Even after updating, your site could still be hacked. This is probably the most worrying part. During the UpdraftCentral incident, some infected sites created new administrator accounts even after their connections had been revoked. With Rank Math and Smart Slider, malware could leave backdoors outside the original plugin. So installing the latest clean version might stop the original attack, but it doesn’t necessarily remove what the attacker has already planted.
That’s why I think we need to stop treating a successful update as proof that a website is secure.
Keeping plugins updated is still essential, but agencies now need reliable ways to block suspicious activity and detect malware that’s already inside.
Is WordPress solving this?
Partially. Since June, every plugin update on WordPress.org waits in a 6-hour cooldown, and since September, an automated review can block risky releases during that window.
But this only covers plugins distributed through the repo. Premium plugins skip this completely, and that’s where most of these incidents are happening because of a forgotten server, the developer’s own website, keys stored in the wrong place.
Agencies and site owners can push their premium plugins to take some essential steps. Honestly, no vendor wants to be caught in such instances, so most of them might already be working on this, or at least considering it. So asking will only help.
Some helpful steps they can start with:
Sign every release. The plugin should verify the signature before installing anything, so your site can tell a real update from a fake one.
Lock down publishing. Strong logins for anyone who can release, signing keys kept off the hosting servers, and old servers shut down.
Make remote access revocable. Customers should see what a connection can do and be able to cut it off for any site.
Disclose incidents clearly. Say which versions were affected, for how long, and whether installing the clean version is enough. With Rank Math, it wasn’t.
How MalCare protects against such attacks
While the ecosystem catches up, we’ve already extended MalCare’s capabilities to address different stages of these attacks, from preventing a compromised update to finding malware that’s already inside a website.
Here’s some of the new stuff we’ve been working on:
1) Stop known malicious updates before they’re installed
In the Rank Math incident, the best outcome was never “clean up fast”. It was making sure the poisoned release never reached your sites at all.
That’s what we’ve built. MalCare now puts security controls around plugin installs and managed updates. The moment we identify a release as compromised, we can block it across every site we protect, before anyone clicks update.
Most security tools only start working once the malware is already on the site. We wanted to stop it one step earlier.
2) Block attacks even when they use trusted connections
This is the part that worries me most about these attacks. They don’t look like attacks. A command from a connected dashboard looks exactly like something your own team would do.
So MalCare’s firewall doesn’t just watch the front door. It inspects sensitive WordPress actions too, including those coming through remote-management channels that most firewalls simply trust.
During the UpdraftCentral incident, we used this to restrict malicious activity coming through compromised connections, while the attack was still unfolding.
Our security team ships targeted rules for each new attack method. And when an attack is too new or too slippery for a narrow rule, we deploy broader restrictions to protect sites first, then fine-tune.
3) Detect and patch vulnerabilities faster than ever before
When the next vulnerability lands, you need two answers quickly: does this affect any of my sites? And if it does, are they protected?
Vulnerability Shield 2.0 answers both, with unmatched speed and control. You can now:
know about serious vulnerabilities within minutes of disclosure
see exactly what needs attention from one central dashboard
get virtual patches deployed within minutes
Our rapid response system patches most vulnerabilities within minutes, drawing on a library of 19,000+ patches. And when something genuinely new appears, we test and ship a new patch within a few hours, so the protection actually holds as attacks evolve.
4) Identify compromised plugins and find the backdoors they leave behind
In the Rank Math incident, the malicious code could plant backdoors elsewhere on the site. Updating to the clean version wouldn’t touch them.
That’s why MalCare’s scanner doesn’t just check plugins. It looks across the whole site for known malware, suspicious code and unusual behaviour, from a sudden file change to a plugin that shouldn’t be there. During the Rank Math and UpdraftPlus incidents, it was already flagging affected sites.
Now we’re taking this further. MalCare will clearly label known compromised releases, so you can see exactly which of your sites are affected by an incident and what needs to be done.
5) Make urgent fixes easier across hundreds of sites
During the UpdraftCentral incident, one of our largest agency customers had to rotate compromised connection keys across hundreds of sites. With our Code Snippets Manager, they did it in one go instead of logging into each site.
These are the types of new controls we’re adding, because a security incident shouldn’t mean two days of your team repeating the same fix on site after site.
What site owners and agencies should do next
If you run updates across sites regularly, here are some new steps I’d have in place.
Stage premium updates first. Give them a few hours on staging before they reach every site, since several of the poisoned updates above were live for under a day. Don’t hold back security fixes, though.
Log what you meant to change. Record the plugin version, update date and package source for each site. Anything that doesn’t match, like a new admin user or a plugin you never installed, is your first lead. An activity log helps here, because it records these changes automatically.
Know what’s connected to each site. List every remote management tool, backup dashboard and integration, including inherited ones. Remove what you don’t use, and question anything that can install plugins.
Keep backups from before the incident, and test them. Restore one onto staging to check it works, and keep older copies. After a poisoned update, you need the version from before it went out.
Name the person who can cut access. Decide who reads security alerts and who can revoke a connection on every site. Send a test alert to make sure it reaches them.
When you face an incident like the ones I mentioned earlier -
Check exact versions and dates. Activity Log shows what you installed and when, and Vulnerability Shield shows which sites are affected.
Cut off access first. Revoke keys and rotate credentials before cleaning. Code Snippets can do this across multiple sites.
Look for what’s left behind. Run a MalCare scan and check Activity Log for unfamiliar admins and sessions. As Rank Math showed, updating won’t remove these.
Restore from before the window, then scan again to confirm the site is clean.
We’ll keep improving MalCare as these attacks evolve. The less time your team spends worrying about the next incident, the better we’re doing our job.
