PHP & WordPress

WordPress Attacks in 2026: wp2shell, Elementor Pro, Bricksforge and What They Mean for Your Site

WordPress runs over 40% of all websites, which makes it the biggest target on the web. Most WordPress hacks are not clever: an attacker scans millions of sites for one known-vulnerable plugin version and uploads a PHP backdoor to every one it finds. 2026 has been an unusually busy year, with critical bugs in WordPress core, in widely used plugins and in PHP itself. This guide summarises the attacks that mattered, explains the pattern behind them, and gives you a checklist to confirm your own site is safe.

By WebsNexus · October 25, 2026 · 5 min read · Updated October 25, 2026

Notable WordPress-related vulnerabilities exploited in 2026

Vulnerability	What it hit	Fixed in	What attackers did
wp2shell (CVE-2026-63030 + CVE-2026-60137)	WordPress core 6.9 and 7.0	WordPress 7.0.2 (17 July, forced auto-update)	Unauthenticated code execution; public exploits within days
Elementor Pro CVE-2026-32475	Elementor Pro up to 4.2.1 with a form upload field	Elementor Pro 4.2.2 (19 August)	Uploaded PHP web shells; Wordfence blocked about 200,000 attempts
WordPress core critical fix	WordPress 7.1 and older branches	WordPress 7.1.2 (22 September)	Probes began on patch day
Bricksforge CVE-2026-85097	Bricksforge up to 3.1.8.9	Bricksforge 3.1.8.10	Unauthenticated file upload exploited from 7 October
WooCommerce Wholesale Lead Capture CVE-2026-27540	Plugin up to 2.0.3.1	2.0.3.2 (February)	Still exploited months after the fix; 100,000+ attempts blocked
PHP2Shell (CVE-2026-109618/109619)	PHP itself, every version since 5.4	PHP 8.5.12, 8.4.27, 8.3.36, 8.2.35 (21 October)	Exploitation seen before disclosure

wp2shell: when WordPress core itself was the target

In July 2026, researchers at Assetnote reported a chain of two core bugs: a REST API batch-route confusion (CVE-2026-63030) and an SQL injection in WP_Query’s author__not_in parameter (CVE-2026-60137). Together they allowed unauthenticated remote code execution on default installations of WordPress 6.9 and 7.0. WordPress 7.0.2 fixed them on 17 July, and WordPress.org forced the update through auto-updates for affected sites. Public exploits appeared within days.

The lesson is that auto-updates for WordPress core work and should stay on. Sites that had disabled them, or that run a heavily customised core, stayed exposed long after the fix.

Plugins are still where most attacks land

Patchstack’s State of WordPress Security in 2026 report counted 11,334 new WordPress ecosystem vulnerabilities in 2025, 42% more than the year before. 91% were in plugins, 9% in themes and only a handful in core. Nearly half had no patch available when they were disclosed, and for the most heavily exploited flaws the median time from disclosure to mass exploitation was about five hours.

This year’s plugin attacks fit that pattern. The Elementor Pro flaw let anyone upload a PHP file through a form with a file-upload field, and Wordfence reported attacks from the day the fix shipped. The Bricksforge flaw, rated 9.8 to 10.0, was exploited by automated tools from 7 October. A WooCommerce wholesale plugin bug was still being exploited months after its February fix, because many sites never updated.

PHP2Shell: the layer most owners forget

In October the risk moved below WordPress entirely. The PHP2Shell vulnerabilities live in the PHP engine, so a WordPress site with a perfectly updated core and plugins is still exposed if its server runs an unpatched PHP version. WordPress’s Site Health screen shows your PHP version; if it is below 8.2.35, 8.3.36, 8.4.27 or 8.5.12, ask your host to update or switch it.

Sites on PHP 7.x, still common on older shared hosting plans, have no official fix. For these sites, moving to a supported PHP version is now urgent, and it is often the moment to ask whether WordPress is still the right platform.

Checklist: is your WordPress site safe right now?

Check that WordPress core is on the latest release (7.1.3 or newer as of October 2026) and that automatic background updates are on. Update every plugin and theme, and delete, not just deactivate, those you do not use. Confirm the PHP version is patched. Review Users for administrators you do not recognise, and look in wp-content/uploads, including uploads/elementor/forms, for any .php files, which should never be there.

Then check the basics that limit damage: two-factor login for every administrator, a web application firewall, daily off-site backups you have actually tested restoring, and uptime and file-change monitoring. Our website security audit checklist covers each step in more detail.

When to move off WordPress

WordPress is a good choice for many content sites, and leaving it is not a security fix by itself. But if your site depends on 30 or more plugins, a page builder, and custom PHP from a developer you can no longer reach, every month brings new plugin updates to test and new vulnerabilities to chase. A site rebuilt in Next.js, with content in a headless CMS, has a far smaller attack surface: no PHP on the public server, no plugin ecosystem, and pages served as static files from a CDN.

WebsNexus does both: we secure and maintain existing WordPress sites, and we migrate WordPress and PHP sites to Next.js while keeping URLs, content and rankings. Security reviews start from $100 and rebuilds from $500. Message us on WhatsApp at +92 326 6379003 for a quick check.

Frequently asked questions

What is wp2shell?

wp2shell is a chain of two WordPress core vulnerabilities, CVE-2026-63030 and CVE-2026-60137, that allowed unauthenticated remote code execution on WordPress 6.9 and 7.0. It was fixed in WordPress 7.0.2 on 17 July 2026 and pushed to sites through forced auto-updates.

Which WordPress plugins were exploited in 2026?

Widely reported examples include Elementor Pro (CVE-2026-32475, fixed in 4.2.2), Bricksforge (CVE-2026-85097, fixed in 3.1.8.10) and WooCommerce Wholesale Lead Capture (CVE-2026-27540, fixed in 2.0.3.2).

Why are WordPress plugins so often hacked?

There are tens of thousands of plugins written by developers of very different skill, many sites never update them, and attackers can scan the whole web for one vulnerable version. Patchstack found 91% of new WordPress vulnerabilities in 2025 were in plugins.

Does updating WordPress protect against PHP2Shell?

No. PHP2Shell is a bug in PHP, not WordPress. You need a patched PHP version: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer.

Is Next.js more secure than WordPress?

A Next.js site with content from a headless CMS usually has a smaller attack surface, because there is no public PHP, no plugin ecosystem and most pages are static. It still needs secure code, updated dependencies and safe hosting.