Critical Vulnerabilities in Major WordPress Plugins Expose Millions of Sites to Attack

Over the past several weeks, security researchers and plugin developers discovered a wave of critical vulnerabilities in widely used WordPress plugins. These flaws include remote code execution, SQL injection, privilege escalation, and authentication bypass, affecting both established and newer plugins.

The vulnerabilities first came to light as reports surfaced of attackers exploiting weak file upload validation and broken access controls. The affected plugins are installed on millions of sites, making the impact far-reaching. As news spread, both security firms and plugin developers began issuing advisories and patches.

On August 19, 2026, a flaw in the Forminator Forms plugin was reported, exposing over 600,000 sites to unauthenticated remote code execution. The following days saw similar disclosures for the Outranking, InfiniteWP Client, and Pods plugins, each affecting tens or hundreds of thousands of sites with risks of admin access or database compromise.

By late August, attackers began targeting the Everest Forms and miniOrange SAML 2.0 Single Sign-On plugins, with vulnerabilities enabling complete site takeovers and admin account hijacking. Security researchers documented active exploitation of these flaws, some with severity scores as high as 9.8 out of 10.

The pace intensified as flaws were found in WPMU DEV Dashboard, Sigma Forms Pro, and the widely used All-in-One WP Migration and Backup plugin. The latter, with over five million active installations, was found vulnerable to unauthenticated SQL injection, enabling attackers to take control of affected sites.

By early September, attacks expanded to the Super Forms and Elementor Pro plugins. Security firms recorded over 440,000 exploit attempts targeting these flaws, with attackers uploading webshells and executing arbitrary code on compromised servers. Patches have been released for many of the affected plugins, but not all sites have applied them.

Millions of WordPress sites remain vulnerable as attackers continue to scan for and exploit unpatched plugins. Security firms have confirmed ongoing exploitation, with some attacks leading to full site takeovers and persistent backdoors.

Many plugin developers have issued fixes, but the large number of affected sites means that full remediation will take time. Website owners are being urged to update their plugins immediately and to monitor their sites for unusual activity or signs of compromise.

The situation remains fluid as researchers monitor for new exploits and plugin developers work to patch additional flaws. Website owners should expect further advisories and may need to apply more updates as new vulnerabilities are discovered or as attackers shift tactics.