A wave of attacks on WordPress plugins, check whether you use any of these
The last few weeks have brought a genuine wave of automated attacks on WordPress sites. Attackers do not pick targets by hand, they scan the whole internet for sites with a specific, vulnerable plugin and strike en masse. If your site uses one of the popular add-ons, it is worth spending five minutes to check whether you are on the list.
Below are three flaws that are already being actively exploited, not in theory, but in real break-ins counted in tens of thousands of attempts.
Everest Forms Pro: full site takeover
Everest Forms is one of the more popular contact form plugins. The flaw found in it (CVE-2026-3300) scored 9.8 out of 10, the highest threat level. It lets an attacker, without logging in, run their own code on the server, create an administrator account and drop in a so-called webshell, a back door to the site.
Threat-monitoring firms recorded over 29,000 attack attempts. This is not a distant risk, it is happening now.
If your site has a contact form based on Everest Forms, update the plugin to the latest version right away. And better still, check whether any new, unknown administrator accounts have appeared.
WP Maps Pro: a silent administrator in the background
The map-embedding plugin has a flaw (CVE-2026-8732) that lets an attacker create an administrator account with a single request, without a password, without logging in, without a conspicuous trace. It quietly adds a new "owner" to your site.
The worst thing about this type of attack is that the site keeps working normally. It looks fine, customers see nothing, and a stranger has full access to the panel and waits for the right moment.
Modular DS: a score of 10 out of 10
The flaw in the Modular DS tool (CVE-2026-23550) received the maximum possible score: 10 out of 10. The first attacks using it were noted earlier this year and are still ongoing. If you use this solution to manage sites, updating is an absolute priority.
What to do: concretely
You do not have to be an IT expert to defend yourself. A few steps are enough:
- Update all plugins and themes. Not just the ones on the list, flaws appear every week. The simplest way is to enable automatic plugin updates in the WordPress panel.
- Remove plugins you do not use. Every inactive add-on is a potential way in. A disabled plugin can still be vulnerable.
- Check the user list. Panel → Users → Administrator. If you see an account you did not create, you have a problem and need to act immediately.
- Make a backup. Before you change anything, have a current backup of the site and the database. That is your safety net.
How to tell something is happening
The symptoms of a compromised site can be subtle: strange redirects, a sudden drop in Google, a "This site may be dangerous" warning in the browser, slower performance, or emails from your host about sending spam. If any of that sounds familiar, do not wait.
Keeping up with new flaws is a full-time job. That is why, as part of caring for a site, we monitor vulnerabilities continuously, update plugins before they become a problem, and react before an attacker does. If you want peace of mind, get in touch, we will check your site.
Sources: Rescana, Everest Forms Pro (CVE-2026-3300), Threat-Modeling.com, WP Maps Pro (CVE-2026-8732), TechRadar Pro, mass WordPress site takeovers.