October 2026 has been a busy month for WordPress security. One page-builder add-on is being actively exploited, and one of the most popular backup plugins has had its connection keys stolen. Here’s what happened and what to check on your own site.
Bricksforge: critical flaw under attack
Bricksforge, an add-on for the Bricks page builder, had a flaw (CVE-2026-85097) that let anyone upload and run PHP code on a site without logging in. It’s rated 10 out of 10 by Patchstack and 9.8 by Wordfence. Patchstack saw attacks begin on 7 October, from dozens of IP addresses scanning for vulnerable sites.
- Affected: Bricksforge 3.1.8.9 and earlier.
- What to do: update Bricksforge to the latest version (4.0.1 or later). If your site was running an affected version after 7 October, have it checked for uploaded files and unfamiliar admin users.
UpdraftPlus: stolen connection keys
This one isn’t a bug in the plugin. Over the weekend of 17–18 October, attackers broke into TeamUpdraft’s own website, the company behind UpdraftPlus. They took UpdraftCentral connection keys, which let a remote dashboard control a WordPress site, and on 18–19 October they used them to install backdoor plugins on sites.
Around 400,000 sites could hold a key. That’s the potential exposure, not the number of hacked sites. A site can hold a key even if its owner never used UpdraftCentral.
- Update UpdraftPlus to 1.26.13 (free) or 2.26.13 (Premium). Earlier October builds didn’t remove the keys.
- Delete any connection key under Settings → UpdraftPlus → Advanced Tools → UpdraftCentral.
- Check Users for administrators you don’t recognise, and Plugins (including the Must-Use tab) for anything unfamiliar.
- If you have a teamupdraft.com account, change the password and reset two-factor authentication.
Updating alone won’t remove a backdoor that’s already been installed, so the manual checks matter.
Other plugin flaws this week
On 24 October, a privilege escalation flaw was also disclosed in the aBlocks plugin (CVE-2026-110018, versions up to 2.17.0), along with a cross-site scripting flaw in BP Better Messages (CVE-2026-114179). If you use either plugin, update it as soon as a fixed version is available.
How to stay ahead
- Turn on automatic updates for plugins, or check for updates at least weekly.
- Remove plugins you don’t use. Every plugin is something else to keep patched.
- Keep off-site backups, so a hacked site can be restored quickly.
- Use two-factor authentication on every administrator account.
If you’d rather not keep track of all this yourself, my WordPress maintenance and security service covers updates, monitoring and clean-ups. Get in touch if you’re worried your site has been affected.
Sources
- The Hacker News: Bricksforge flaw exploited
- SecurityWeek: Bricksforge exploited in the wild
- The Hacker News: UpdraftCentral keys abused
- Patchstack: UpdraftCentral key compromise
