WordPress vulnerabilities, October 2026: 7.1.4, a Rank Math PRO backdoor, stolen UpdraftCentral keys and Bricksforge

October was the month the update itself became the attack. Two of the four stories below did not start with a bug in anybody's code. They started with an attacker reaching the place your updates come from, and in both of them, updating afterwards fixes nothing on a site that was already reached.

Here is what happened, in order of how many sites it touches, with the version that fixes each one, what to look for when a version is not enough, and what Respira does about each. The core versions on this page are read from the same table the Respira scanner judges sites against, so the two cannot disagree.

If you only have five minutes

1. WordPress: be on 7.1.4, or the patch for your branch: 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15 or 6.1.16, with backports down to 4.7.39.
2. Rank Math SEO PRO: if you ran 3.0.123 between 15 and 16 October, look for an administrator whose login starts with wpsupport_ before you do anything else. Updating does not clean it.
3. UpdraftPlus: be on 1.26.13 (free) or 2.26.13 (Premium), then look for administrators, editors and plugins nobody on your team added since 17 October.
4. Bricksforge: be on 3.1.8.10, then ask your host whether any PHP file sits in wp-content/uploads/bricksforge/tmp/.
5. Everything else: run the free scanner on your site. It needs no install and takes about 20 seconds.

WordPress 7.1.4: 22 fixes, one in the updater itself

WordPress shipped 7.1.4 on 28 October 2026 as a security-only release. WordPress lists twelve items; Patchstack counts them as 22 vulnerabilities, three times October's first release three weeks earlier. The headline is unusual: a weakness in the core upgrade process that can allow code execution, with no login, during the few seconds an update is running. Researchers rate it hard to exploit because the window is short, but it opens again on every update, automatic ones included.

The rest is mostly stored cross-site scripting reachable from a Contributor account: block markup, the Categories, Image, Playlist and comment pagination blocks, Customizer selective refresh, and five separate issues in the Interactivity API. Two more need no account at all to matter: unpublished Customizer changesets that anyone could find, and Notes readable by users without access to the post. The release also replaces the bundled root certificates after the eMudhra revocation. No CVE identifiers had been published and no exploitation reported as of 29 October.

The fix: 7.1.4, 7.0.8, 6.9.11, 6.8.12, 6.7.11, 6.6.11, 6.5.14, 6.4.14, 6.3.14, 6.2.15 or 6.1.16, with backports down to 4.7.39. Compare against your own branch, not the newest WordPress, and note that the 6 October patches (7.1.3, 7.0.7, 6.9.10) do not carry this release. Most sites apply it on their own within a day. Some never do: a disabled auto-update, a host that pins versions, or a site nobody has logged into since spring.

One host-side step is worth asking for while you are at it. Patchstack advises denying web access to wp-content/upgrade/ and making sure it cannot be listed, which closes the update-window path on every future update. That is a server rule, so it is your host's to add.

October also had the PHP flaw underneath WordPress, CVE-2026-109618 and CVE-2026-109619, which no WordPress update can fix. That one has its own page: the PHP vulnerability and your WordPress site, with the message to send your host.

Rank Math SEO PRO 3.0.123: a backdoor that came as an update

Between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026, copies of Rank Math SEO PRO 3.0.123 downloaded from Rank Math carried malware, after an attacker reached their distribution. It is tracked as CVE-2026-111862, rated 9.8. Once active, the code keeps persistent access, rebuilds a hidden backdoor whenever someone visits the site, talks to rank1cdn.com, and can expose WordPress, database and API credentials. The free Rank Math SEO on WordPress.org was not affected.

This is the part that catches people: 3.0.124 is clean, and installing it cleans nothing. It replaces the plugin's own files. What the malware planted lives elsewhere: a fake core file at wp-includes/class-wp-cache-util.php, PHP files in mu-plugins, uploads and theme folders, .cache files with an .htaccess rule that lets them run, administrators named wpsupport_ followed by random characters or with an email at wp-mail.net, three options (_uf6qdn2hmm, t8krdk990phb, _np5pvf754c) and a system crontab entry tagged #ms6v46.

What to do, in Rank Math's order: if an affected copy was active, restore the site and database from a backup taken before 20:02 UTC on 15 October. Without one, delete the whole plugin folder (deactivating is not enough), remove the three options, block rank1cdn.com, and only then hunt the remaining files, accounts and scheduled tasks. Either way, rotate every credential afterwards, including the database password and the salts in wp-config.php, and download 3.0.124 directly from rankmath.com. Rank Math says it never sends download links by email, which matters this month.

Having 3.0.123 does not prove a site was hit. The same version number was clean outside the eleven-hour window. It is still a version worth an hour of checking, and on a site you manage for a client, an hour you can bill.

UpdraftCentral: stolen keys, valid signatures

On the weekend of 17 and 18 October 2026, an intruder reached teamupdraft.com and took customer data, including the connection keys sites use for UpdraftCentral, UpdraftVault and UpdraftClone. The UpdraftCentral keys were then used against the sites they belonged to: administrator accounts created, malicious plugins installed, some disguised as maintenance tools. TeamUpdraft's own write-up is clear that the full extent is unknown.

Nothing here was a bug in UpdraftPlus. The commands carried valid signatures, so every connected site obeyed them as if they came from its owner, which is also why no security plugin flagged them. UpdraftPlus is on more than four million sites; only those connected to the cloud UpdraftCentral at updraftplus.com could be reached this way, and self-hosted UpdraftCentral was not affected. A connection can exist without anyone remembering making it.

The fix: UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium), released on 19 October, revoke every UpdraftCentral connection made before 18 October. Then:

• Look for administrator and editor accounts created on or after 17 October that nobody on your team made.
• Look at every plugin, including the Must-Use tab, which wp-admin only shows when one exists.
• Under Settings > UpdraftPlus > Advanced Tools > UpdraftCentral, delete any key you do not recognise.
• Re-authorise remote storage and change its access keys if the site was managed through UpdraftCentral, and change your teamupdraft.com password.
• If anything turns up, TeamUpdraft suggests restoring from a backup taken before 17 October.

Bricksforge: exploited the day before its fix

Bricksforge, a widely used add-on for the Bricks builder, checked a file's type on the first upload and then trusted the path the browser sent back when the form was submitted. With no login, an attacker uploads an image, then submits the form with a temporaryFileUploads value that moves it to a .php path, and runs it. It is CVE-2026-85097, rated 9.8 to 10.0 depending on who you ask.

Patchstack saw the first attacks at 21:47 UTC on 7 October 2026, from 63 addresses, before the fix was public. Versions up to 3.1.8.9 are affected; 3.1.8.10 fixes it. Bricksforge is sold outside WordPress.org, so the update arrives through its own licence, and an expired licence means it does not arrive.

After updating, ask your host to look for PHP files in wp-content/uploads/bricksforge/tmp/ and wp-content/uploads/2026/10/, files named login_admin_*.php, and requests to /wp-json/bricksforge/v1/form_submit carrying temporaryFileUploads in the access logs.

The rest of the month: 71 critical records

Between 1 and 28 October 2026 the Wordfence Intelligence database gained 1,907 WordPress records, 71 of them rated critical, across 65 plugins and themes. Most are on software with a few hundred installs. These are the critical ones on plugins with at least 10,000 active installs, as WordPress.org reported on 29 October.

Plugin	Active installs	Fixed in	Published	Record
Click to Chat (HoliThemes) Unauthenticated shortcode execution through the {url} placeholder.	600,000	4.45	13 October	CVE-2026-92097 · 9.1
Kirki Unauthenticated remote code execution.	500,000	6.3.2	1 October	CVE-2026-103065 · 9.8
Blocksy Companion Unauthenticated privilege escalation through the role parameter.	300,000	2.1.59	9 October	CVE-2026-107645 · 9.1
Advanced Custom Fields: Extended Unauthenticated remote code execution, published with an account takeover and a file deletion flaw fixed in the same release.	100,000	0.9.2.8	23 October	CVE-2026-94267 · 9.8
Beaver Builder (Lite) Unauthenticated shortcode execution through the Sidebar module.	100,000	2.11.0.6	2 October	CVE-2026-92084 · 9.1
LatePoint Unauthenticated authentication bypass through a race on one-time-code attempts.	100,000	5.7.5	16 October	CVE-2026-110653 · 9.1
LearnPress Unauthenticated PHP object injection through the checkout email field.	70,000	4.4.11	16 October	CVE-2026-104736 · 9.8
10Web Booster Unauthenticated arbitrary file upload.	60,000	2.34.11	14 October	CVE-2026-108587 · 9.8
Theme My Login Unauthenticated privilege escalation through the password field.	50,000	7.2.2	15 October	CVE-2026-89079 · 9.8
PPOM for WooCommerce Unauthenticated arbitrary file deletion.	20,000	34.0.11	9 October	CVE-2026-104801 · 9.1
My Calendar Unauthenticated privilege escalation through reflected shortcode injection.	20,000	3.8.8 (or 3.7.18, 3.6.18, 3.5.22, 3.4.25 on older branches)	15 October	CVE-2026-104798 · 9.8
MailOptin Unauthenticated privilege escalation through custom field mappings.	10,000	1.2.78.7	15 October	CVE-2026-109515 · 9.8
Prime Mover Unauthenticated PHP object injection during migration search.	10,000	2.2.2	22 October	CVE-2026-115806 · 9.8
weForms Unauthenticated arbitrary file deletion.	10,000	1.6.29	19 October	CVE-2026-111833 · 9.1

Three page builders had critical records this month: Beaver Builder above, and Avada and YOOtheme Pro below. If you build client sites on any of them, those are the updates to check first, because a builder runs on every page of the site.

Duplicator, on about a million sites, had a high-rated unauthenticated PHP object injection (CVE-2026-82814, 8.8) in Duplicator up to 1.5.17 and Duplicator Pro up to 4.6.10, fixed in 5.0.0. No attacks were reported. A Duplicator Pro still on 4.x is the one to look for.

Paid plugins and themes

These publish no install count. They are also the ones most often running on a licence that expired quietly, which is the usual reason a paid plugin stays unpatched.

Plugin or theme	Fixed in	Published	Record
YOOtheme Pro Unauthenticated arbitrary file upload in 5.0.0 to 5.0.52.	5.0.53	22 October	CVE-2026-102785 · 9.8
Avada (Fusion) Builder Unauthenticated invocation of arbitrary WordPress actions.	3.16.2	9 October	CVE-2026-97670 · 9.1
Jupiter X Core Unauthenticated authentication bypass through the X (Twitter) social login.	4.62.0	27 October	CVE-2026-106013 · 9.8
The Grid Unauthenticated remote code execution.	2.8.2	14 October	CVE-2026-94169 · 9.8
Divi Membership Unauthenticated authentication bypass, published with a privilege escalation fixed in 2.3.0.	3.0.0	1 October	CVE-2026-19660 · 9.8
Abandoned Cart Pro for WooCommerce Unauthenticated SQL injection, published with an authentication bypass fixed in the same release.	10.8.1	13 October	CVE-2026-97668 · 9.8
Pie Register Premium Unauthenticated arbitrary file upload.	3.8.4.1	27 October	CVE-2026-84999 · 9.8

When there is no fix, or the fix is not the fix

Fourteen of October's critical records have no patched version at all. Most of those plugins have since been closed on WordPress.org. The one still listed with real installs is Everest Backup, on about 3,000 sites, with an unauthenticated remote code execution in every version up to 2.3.13, which is also the newest release as of 29 October. Rank Math PRO and UpdraftCentral are the other kind: a fix exists, and it does not undo what already happened.

Both lead to the same awkward step: removing a plugin you no longer trust. The usual way, deactivate and then delete, runs that plugin's own deactivation and uninstall code on the way out. If the plugin is the attacker's, that is one more run of their code, as an administrator, at the moment it knows it has been found. And once the folder is deleted, the only record of what it did is gone.

The safer order: take it out of the active list without firing its hooks, move its folder where the web server will not run it, keep the files for whoever investigates, and replace it. If your host or developer can do that by hand, ask them to. The next section shows how Respira does it.

What Respira does about each one

I build Respira, so read this section knowing that. Everything below is in the product today, and the version-matching parts are free.

Find out in 20 seconds, with nothing installed

The free WordPress vulnerability scanner reads what your site shows anyone: the WordPress version, the plugins and themes the page loads and their public version files, and the PHP version when the server reveals it. It checks them against the whole Wordfence Intelligence database, 43,130 records, refreshed every six hours. It cannot see a plugin a page never loads or anything behind the login, and it says so rather than calling the site fine.

Every connected site, every six hours

On a site connected to Respira, the security audit reads every installed plugin, theme and core version, including plugins wp-admin does not show, and matches them against the same database. A scan stored last week is re-checked against today's records every time you open it, so the four advisories above reached every connected site as soon as they were added, with no rescan. All four are now in the hand-reviewed list, with checks a version number cannot do:

• Rank Math PRO: flags 3.0.123 without offering an update button, because an update is not the fix. An administrator whose login starts with wpsupport_, or the fake class-wp-cache-util.php found by the deep scan's core file check, turns the finding into a possible compromise.
• UpdraftCentral: knows the free and Premium lines apart, so Premium is never told to install the free version, and lists administrators created recently next to the finding.
• Bricksforge: flags below 3.1.8.10, and tests whether your uploads folder executes PHP by writing one harmless file, requesting it and deleting it. Where uploads do not run PHP, an upload bug drops an inert file instead of a shell.
• WordPress 7.1.4: judges each site against its own branch patch, not the newest WordPress.

Across the sites connected to Respira with a recent scan, 23 of 76 run Rank Math PRO and 9 run UpdraftPlus, which is why these two got their own checks the day after the news.

Update with a restore point, and undo it if the site breaks

For a fix that is an update, the guarded update takes a restore point, updates the plugin, then checks four things: the site answers, the front page and the last edited page answer, no new fatal error in the debug log, and the page builder still renders. If any of them fails, it rolls back and tells you what it saw. Nothing updates until you approve it.

Quarantine a plugin without running it

For a plugin with no fix, or one you no longer trust, quarantine takes it out of the active list without firing any of its hooks, moves its folder out of the plugins directory to where the web server will not run it, and writes a manifest of every file with its size, date and hash. Moving it back is one step. It exists because of a real cleanup on 1 October, where removing a planted plugin the normal way gave its code one last run.

Ask for it in plain words

In Respira AER, the chat in your Respira dashboard that edits your WordPress sites, /fix vulnerabilities audits the site, updates what the database flags to the fixed versions, each with your approval, and audits again. On twenty client sites, that is the difference between knowing about October and having dealt with it.

One limit holds for all of it. A version tells you what is exposed now. It cannot tell you whether something came through before you updated, and for Rank Math PRO and UpdraftCentral that second question is the one that matters. Respira reads what WordPress can see: accounts, plugins, must-use plugins, core files, application passwords. Server crontabs, access logs and backups belong to your host, and every check above says which side it is on.

Scan a site for free, or connect your sites to get the full audit, guarded updates and quarantine.

Questions

Which WordPress version fixes the October 2026 security issues?

WordPress 7.1.4, released on 28 October 2026, with the same fixes backported to every older branch: 7.0.8, 6.9.11, 6.8.12 and one release up on each branch down to 4.7.39. A site that stopped at 7.1.3, the 6 October release, is missing them. WordPress applies minor security releases automatically on most sites, so check the version in Dashboard > Updates rather than assuming.

Is WordPress 7.1.4 being exploited?

No exploitation had been reported as of 29 October 2026, and no CVE identifiers had been published. The most serious fix is a race in the core upgrade process that can reach code execution during the seconds an update runs; researchers rate it hard to exploit. Most of the other fixes are stored cross-site scripting that needs a Contributor account or above.

Was my site affected by the Rank Math SEO PRO 3.0.123 malware?

Only copies of Rank Math SEO PRO 3.0.123 downloaded or updated between 20:02 UTC on 15 October and 07:12 UTC on 16 October 2026 carried the malware, tracked as CVE-2026-111862. Having 3.0.123 alone does not prove a site was hit. The free Rank Math SEO from WordPress.org was not affected. Check for administrators whose login starts with wpsupport_, the file wp-includes/class-wp-cache-util.php, and the options _uf6qdn2hmm, t8krdk990phb and _np5pvf754c.

Does updating Rank Math PRO to 3.0.124 remove the malware?

No. 3.0.124 replaces the plugin's own files and leaves what an activated 3.0.123 planted elsewhere: hidden backdoor files, administrator accounts and scheduled tasks, and the malware recreates its backdoor when someone visits the site. Rank Math recommends restoring from a backup taken before 20:02 UTC on 15 October 2026, then rotating every credential, then installing 3.0.124.

What happened with UpdraftPlus and UpdraftCentral in October 2026?

An intruder reached teamupdraft.com on 17 and 18 October 2026 and took the connection keys sites use for UpdraftCentral, UpdraftVault and UpdraftClone. The UpdraftCentral keys were used to create administrator accounts and install malicious plugins on connected sites. UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) revoke the old keys. The UpdraftPlus plugin itself was not compromised, and self-hosted UpdraftCentral was not affected.

Which Bricksforge version fixes CVE-2026-85097?

Bricksforge 3.1.8.10. Versions up to 3.1.8.9 let anyone upload a PHP file through a Bricksforge form and run it, with no login. Attacks began at 21:47 UTC on 7 October 2026, before the fix was public, so check wp-content/uploads/bricksforge/tmp/ for PHP files even after updating.

What should I do about a plugin with a critical flaw and no fix?

Stop it without running its code, keep its files for inspection, and look for a replacement. Deactivating or deleting a plugin through WordPress runs that plugin's own deactivation and uninstall code, which is the wrong thing to do with a plugin you no longer trust. Respira's quarantine takes a plugin out of the active list without firing any of its hooks and moves its folder where the web server will not run it.

How do I check my WordPress site against all of this for free?

Respira's free WordPress vulnerability scanner reads the WordPress, plugin and theme versions your site shows publicly and checks them against the Wordfence Intelligence database, with no plugin to install. Connected sites get the full check: every installed plugin, theme and core version, re-checked every six hours, plus the account and file checks a public scan cannot see.

Sources

• WordPress.org: WordPress 7.1.4
• Patchstack: WordPress 7.1.4 security release
• WordPress.org: current releases by branch
• Rank Math: PRO 3.0.123 security incident
• Patchstack: Rank Math SEO PRO 3.0.123, embedded malicious code
• SecurityWeek: Rank Math PRO compromised in supply chain attack
• TeamUpdraft: security incident, what customers need to know
• Search Engine Journal: UpdraftPlus security breach
• Patchstack: Bricksforge vulnerability exploited
• The Hacker News: attackers exploit Bricksforge flaw
• Wordfence Intelligence vulnerability database

Checked on 29 October 2026. If a version here stops matching the vendor's advisory, the advisory is right and this page is stale. September's edition is here.