WordPress Plugin Security, September 2026: Three Flaws Your Host Won’t Fix for You
This post contains affiliate links. If you purchase hosting through our links, we may earn a commission at no extra cost to you. We only recommend hosts we have personally tested.
Three WordPress plugin vulnerabilities landed in the past few weeks, two of them are being actively exploited, and together they cover somewhere north of eight million installs. If you run a WordPress blog, at least one of them probably applies to you right now.
This is not a scare post. It is a checklist. Here is what broke, how to tell whether you are affected, and — the part most security articles skip — what your host does and does not do about it on your behalf.
The three flaws, in plain terms
| Plugin | CVE | Fixed in | Exploited? |
|---|---|---|---|
| All-in-One WP Migration and Backup | CVE-2026-19949 | 7.110 | Not observed in the wild |
| Elementor Pro | CVE-2026-32475 | 4.2.2 | Yes — attacks began Aug 19, 2026 |
| Super Forms | CVE-2026-14894 | 6.3.314 | Yes — attacks began Jul 14, 2026 |
1. All-in-One WP Migration — the one most bloggers have
This is the backup and migration plugin with over five million active installs — the one nearly every “how to move your WordPress site” tutorial recommends, including plenty of ours. A second-order SQL injection flaw, disclosed publicly on September 2, 2026, affects every version through 7.109. The patch shipped in 7.110 on August 20.
The mechanics are unusually sneaky. An attacker plants malicious SQL inside a WordPress trackback. Nothing happens. It sits there. Then, weeks or months later, an administrator restores a backup archive — a completely routine action — and the injected SQL executes during the restore. The trigger is you doing your job correctly.
Roughly 3.25 million sites were still running a vulnerable version two weeks after the fix was available. That number is the actual story here: the patch exists, and most people have not applied it.
2. Elementor Pro — being exploited right now
CVE-2026-32475 is an unauthenticated file upload validation bypass in Elementor Pro before 4.2.2, rated critical. Translated: an attacker who does not need an account on your site can upload a PHP file and then execute it. That is full site takeover, not a defacement.
Exploitation started on August 19, 2026 — the day disclosure went public — and Wordfence has blocked more than 190,000 attempts since. The vector requires an Elementor page containing a Form widget with a File Upload field, so not every Elementor Pro site is reachable. Enough are.
3. Super Forms — the same shape, and older
CVE-2026-14894 carries a CVSS score of 9.8: missing file type validation allowing unauthenticated arbitrary file uploads, fixed in 6.3.314. Attacks began July 14 and peaked on August 18 with more than 40,000 requests in a single day. Combined with the Elementor Pro campaign, that is over 440,000 blocked exploit attempts against these two plugins alone.
Your five-minute check
- Open Plugins → Installed Plugins in your dashboard.
- Confirm All-in-One WP Migration is at 7.110 or later. If it is not, update it before you restore any backup.
- Confirm Elementor Pro is at 4.2.2 or later. Elementor Pro updates require a valid licence key — if yours has lapsed, that is why you are not seeing the update, and renewing it is now urgent rather than optional.
- Confirm Super Forms is at 6.3.314 or later, if you use it at all.
- Then check for signs you were already hit: look in
/wp-content/uploads/for.phpfiles. There should not be any. Sort your files by modification date and look for anything changed on a date you did not touch the site.
If you find a stray PHP file in your uploads folder, do not just delete it and move on. Assume the site is compromised, restore from a backup taken before the file appeared, and rotate every password and application key.
What your host actually does about this
This is where hosting choice stops being about page speed and starts being about risk. The gap between tiers is wider than most comparison tables let on.
| Host type | What you get | What you still own |
|---|---|---|
| Budget shared | Server patching, basic firewall, malware scanning on some plans | Every plugin update, every compromised-file cleanup |
| Premium shared (e.g. SiteGround) | Proactive monitoring, WAF rules that often block exploit attempts before a patch exists, free daily backups | Plugin updates, unless you enable auto-updates |
| Managed WordPress (e.g. Kinsta) | Isolated containers, daily backups with one-click restore, staging to test updates, hack-fix guarantees on most providers | Deciding when to update; the safety net is theirs |
The specific thing worth paying for in a week like this is the virtual patch: a firewall rule at the host level that blocks the exploit pattern for every site on the platform, whether or not the individual site owner has updated. Premium and managed hosts deploy those within hours of disclosure. Budget shared hosting generally does not.
The second thing worth paying for is a backup you can actually restore. Note the ugly irony in the All-in-One WP Migration flaw: the exploit fires during a restore. Host-level backups, taken outside WordPress and restored outside WordPress, sidestep that entire class of problem. That is a real argument for not relying solely on a plugin for backups — and it is covered in more depth in our WordPress security guide for bloggers.
Four settings to change today
- Turn on auto-updates for plugins. Plugins → check the box → Enable Auto-updates. The theoretical risk of an auto-update breaking your layout is smaller than the demonstrated risk of sitting two weeks behind a critical patch. If a broken layout genuinely scares you, that is what a staging site is for — and it is a feature worth choosing a host over.
- Disable trackbacks and pingbacks. Settings → Discussion → uncheck “Allow link notifications from other blogs.” Trackbacks are the delivery mechanism in the All-in-One WP Migration flaw and they have been useless for a decade.
- Delete deactivated plugins. A deactivated plugin still has files on your server, and file-upload vulnerabilities do not always care whether the plugin is active. If you are not using it, remove it.
- Check that your backups leave the server. A backup stored only in
/wp-content/dies with the site it was meant to save.
For the wider plugin picture — including which security plugin is worth the dashboard space — see our list of essential WordPress plugins for bloggers.
Frequently asked questions
I use All-in-One WP Migration but I never restore backups. Am I safe?
You are safe until the day you need to restore one — which is, by definition, a day something has already gone wrong. Update to 7.110 or later now so the plugin is clean when you eventually need it.
Does a security plugin protect me from these?
Partly. Firewall rules from a security plugin blocked hundreds of thousands of the Elementor Pro and Super Forms attempts, which is exactly why those blocked-attempt numbers exist. But a firewall rule is a net, not a fix. Updating the plugin is the fix.
Should I switch hosts because of this?
Not because of a single bad month — plugin vulnerabilities are a permanent feature of any large ecosystem, not a sign your host failed. Switch if your host offers no daily backups, no staging environment, and no visible response when a critical WordPress flaw goes public. Those three absences are a pattern, not an incident.
How do I know if my site was already compromised?
Look for PHP files in /wp-content/uploads/, admin users you did not create, unexplained outbound email, and pages appearing in Google’s index that you never published. Any one of those is enough to justify a full restore from a known-good backup.
The bottom line
Two of these three flaws are being exploited today, and the patches for all three already exist. The failure mode in 2026 is almost never “there was no fix” — it is “nobody applied it.” Ten minutes of updates closes all three.
And if this week made you realize your host gives you no backups you would trust and no staging site to test updates on, that is worth fixing before the next disclosure.
See Our Most Secure Hosting Pick → — SiteGround includes proactive security monitoring and free daily backups on every plan. 30-day money-back guarantee.
Sources: BleepingComputer — WordPress backup plugin flaw exposes millions of sites to takeover attacks · The Hacker News — Over 440,000 exploit attempts target Super Forms and Elementor Pro RCE flaws
