Note: Similar to CVE-2026-10795, but I was on 1.26.8, I did not restore a backup or take any action for this to occur, to my knowledge.

TEAM UPDRAFT CONFIRM BREACH TO UPDRAFT-CENTRAL:
Looks like I was lucky to spot it as it happened, killed it, then posted here. Hopefully some of you caught it.

"On October 18, we identified unauthorized access to TeamUpdraft, which we believe may have exposed UpdraftCentral connection keys. Our team has since closed the access route.

Based on our development team’s recommendations, please take the following precautions:

1. Remove the malicious plugin and check for any unfamiliar WordPress users.
2. Delete your existing UpdraftCentral connection keys under Settings → UpdraftPlus → Advanced Tools → UpdraftCentral → Manage existing keys.
3. Change your WordPress administrator and TeamUpdraft account passwords.
4. Update UpdraftPlus to the latest version, then reconnect to UpdraftCentral using a new c"

-----------

My original post:

This morning my site started throwing fatal errors on every page. The cause was a plugin I never installed, called “Image Core” (folder wp-content/plugins/image-core/, author “StoneDock Tools”, version “3.1.1”, described as a “small maintenance toolkit”).

What the plugin does: it hooks init. If a request has ?_6212fc=_BEQI71sdL1mVAkslzjLMnG8ffyJfBwi, it creates a user called render_maint13 (email [render_[email protected]](mailto:[email protected]), display name “Site Tools”). That user gets the Editor role plus the manage_options and install_plugins capabilities. It then logs the visitor in as that user and redirects to wp-admin.

On my site it never got that far. The attacker referenced self::FIELD but had defined the values as global constants, so it died with Undefined constant ImageCore::FIELD before it could create the user. A working version would have been silent.

How it got in: the access logs show no wp-admin login, no plugin upload and no file editor use. Instead there were two POSTs to / with this user agent:

class-udrpc.php is UpdraftPlus’s remote-control library (UpdraftCentral).

Source IP for both: 2a09:bac5:4e21:2e3c::49b:9 (a Cloudflare WARP address, so not the attacker’s real IP).

UpdraftPlus was 1.26.8. An UpdraftCentral key had been created on my site, maybe that leaked somehow, or could be a bug.

Check your site:

Search your access logs for class-udrpc.php in the user agent, or _6212fc in URLs.

Look for wp-content/plugins/image-core/ and a user called render_maint13.

If you run UpdraftPlus: go to Settings → UpdraftPlus → UpdraftCentral, delete any keys you don’t use, and update. Or remove it. Reset your UpdraftPlus login password.

If you were hit: delete the plugin and the user, then rotate your passwords, salts, Application Passwords and API keys.

I got an email this evening that a site I managed had crashed. I logged in using recovery mode and found the offender was a plug-in called Content Module 987 published by QuietPress Labs. A quick search online returned no such publisher or any such plug-in.

I quickly disabled the plug-in and my site started working again. I examined the plug-in. I didn't seem to do much that I could tell looking at the code. I fear the site has been hacked. Anybody heard of something like this before??

Hey everyone,

I'm looking to gather some feedback from fellow WordPress users and email marketers who are currently using or have recently used Mailster.

A bit of context: I bought a lifetime license back when it was sold as a one-time purchase on CodeCanyon (formerly MyMail). Back then, it was a solid, reliable plugin for self-hosted email campaigns.

However, over time I’ve noticed a few changes and concerning trends, and I'd like to see if others are experiencing the same:

1. Abandonment on ThemeForest / Marketplace: A lot of third-party email templates sold on ThemeForest/Envato specifically for Mailster seem abandoned. Authors barely reply to support tickets or pre-sale queries anymore.
2. Shift to Annual Subscription Model: The plugin moved away from CodeCanyon / lifetime updates to its own website with an annual subscription pricing structure for support/updates.
3. Database Bloat & Performance Issues: On larger lists or active setups, the wp_mailster_* database tables tend to bloat significantly with logs, tracking data, and queue records, which can heavily impact site performance if not cleaned manually on a regular basis.
4. Support & Maintenance: General response times and overall maintenance quality seem to have shifted after transitions in ownership/pricing models.

For those still running Mailster:

• How is it holding up on your current WordPress sites?
• Have you noticed severe database bloat or server overhead?
• Have you sticked with Mailster or migrated to options like FluentCRM, MailPoet, or external SaaS (ActiveCampaign, Brevo, etc.)?

Would love to hear your honest thoughts and recent experiences. Thanks!

I run s small VPS for around 10 WP installs. I have DirectAdmin with JetBackup running.

has anyone ever use Backuply? What was your experience, and how was the restore process?

thanks.

I have been working on my WordPress website for about a month now. I want to start selling stickers and other little goods. It was between this and Shopify, but Shopify was expensive and with WordPress it was cheaper and you would pretty much own the site.

I knew it would be a bit harder but I didn't realize how much there is with building on WordPress. I have my plug-ins for the shop, designed it, optimized my website speed, made sure I have security like CloudFlare. I keep running into more things that make me second guess myself. I made myself a maintenance checklist for it.

But I don't see a lot of people with art shops that are on WordPress, so I had to really research and find what I needed. What I'm concerned about is safety, I heard if you don't upkeep the site or make a mistake it can get hacked, and I wouldn't want that for my customers.

How can I be absolutely sure that the website will be safe and continue to be safe? (Also when I am editing and viewing my site it is pretty slow, when i check the Google speed it is at 100 and 90. Is that normal?)

I'm currently at the leadership level at a digital marketing agency. I've been here around 8 years. I have always been at digital marketing agencies my entire career. I actually love agencies. I'm one of the crazy ones. I run all things technical at this agency. I'm wondering what skills I should focus on and learn to stay valuable.

Throughout my stay at this company, I've managed a few full timers, and a few freelancers. Right now though, it's just me. Actually, the majority of my time at this company, it has just been me.

From a pure programming standpoint, it's marketing websites. Mostly custom WordPress websites with various degrees of complexity. We use as little plugins as humanly possible. This could mean anything from a 4 page brochure website to a large multi-site with a custom single-sign on member portal using a 3rd party API no one has ever heard of, all hand-coded by me. Tons of bespoke solutions to unique problems over the years. Tons of APIs, platforms, etc.

I also run the hosting side of the business. What this means is managing our reseller account, administering clients, choosing what packages we offer, how much they cost, managing our client backup strategy, managing monitoring and outages (I am the one getting out of bed at midnight when my phone lights up), launching new websites, etc. etc.

I've also created our devops strategy and implementation. Not especially complex for a marketing agency, but it's there. Every client in git, deploys to a staging server, deploys to a prod environment, etc. Normal stuff. In the past I have managed our full timers and freelancers access to this system. In rare cases a client dev also needs access and I will manage that as well.

Along with all of this, there is also lots of technical marketing tasks that I help with. I help create and debug Google Analytics triggers, campaign attribution, things like "why are there 5 form entries with UTM strings but Facebook only says 3 conversions", technical SEO cleanups, etc. Over the years I have integrated with lots of CRMs and marketing platforms. Hubspot, Salesforce, Pardot, Slate, Mailchimp, etc. Setting up marketing emails, setting up editable templates in those platforms, setting up forms that will embed on the site, setting up the site to pass hidden data into these forms, API calls that trigger CRM emails based on an action taken on the website, etc. Lots of client needs over the years.

Lastly, I am very client-facing. I am in most client meetings. There are lots of meetings that I set up and run myself, being the lone rep from my company in the meeting. I train all the clients on their systems. In lots of cases I am the one they email and interface with for a request.

With AI, I honestly don't know how valuable any of this stuff is that I do, lol. I've been using AI daily, and I'm not an idiot. I can clearly see a world where AI does everything I have mentioned above. Right now my strategy is to try and become an AI expert, and try to figure out new ways to use AI to benefit our customers. At the core of who I am, the reason I have stayed with agencies forever, is because I love helping a wide array of people. Always new people, always new problems. I like being their technical resource.

What would you guys do? I don't even know if agencies will exist in 5 years. What skills should I learn? What jobs should I be aiming for?

Hey everyone,

I've been working on a WordPress plugin recently because I kept running into the same problem over and over.

**I'm the developer of this plugin and I'm mainly looking for feedback from the WordPress community.**

A user reports a bug, and the entire report is basically:

"It doesn't work."

Now I have to figure out what page they were on, what they clicked, what they expected to happen, and how to reproduce it.

So I started wondering if it would be easier to just let people explain the problem out loud while they're using the site.

That idea turned into a plugin called Nik Voice Ticketing AI.

Instead of filling out a support form, visitors can record a short voice message and click through the page while explaining what's wrong. The plugin records their voice along with a timeline of clicks and page interactions. It can also use AI to turn everything into a cleaner support ticket.

It's completely open source and free.

WordPress:

https://wordpress.org/plugins/nik-voice-ticketing-ai/

GitHub:

https://github.com/Nik-Neural-AI-Inc/nik-voice-ticketing-ai

I'm genuinely curious what WordPress site owners and developers think.

Would love honest feedback, even if your reaction is "I'd never install this."

The gradient is also nice.

I’m trying to build a Wordpress website from scratch. I did same 7 years ago successfully. Now it seems the monetizing aspect is overwhelming. Transparency is totally absent until you get to the end and they suddenly say sorry this plugin isn’t actually a free plugin.

Same for AI assisted plugins advertised as free until the end.

This is the message I have gotten maybe 20 times in the past month (highlighted in yellow). It's word for word the exact same every time. Suggestions please?

[ Removed by Reddit on account of violating the content policy. ]

I have a problem with WordPress,The form on the website doesn't work; the problem logs indicate incorrect authentication.I double-checked all the information, and it's all correct, but it still doesn't work. If you can help, I'd be very grateful.

hey! I was wondering if anyone knew how to do a "checklist feature" like on this site:
https://choro-game.com/e/crazy_chain-guide-flatnis

basically, you can click on options in the walkthrough you selected so you don't lose overview as a user.

Quick summary: I'm a uni student in Istanbul, my only income is my scholarships. One of the people who gives scholarship to me offered me a job that requires webpress. Basically they want me to do the "little things" for the website. Like from changing a text to fixing a bug but only the little things. It's a website for abroad education company.

Do you guys think i can handle this? What would you suggest me to do? Is it viable to learn webpress in 1-2 weeks to take care of the stuff they tell me. Because i need that money desperately.

I'm currently working on my book and planning ahead for marketing. I see conflicting advice online about whether having a dedicated author website is strictly necessary from day one.

For those of you who have been doing this a while:

• Did you set up a website right away, or did you wait until you had a few books out?

• If you don't have one, do you feel like you are missing out on readers or newsletter signups?

• For those who do have one, what platform (WordPress, Carrd, Wix, Shopify, etc.) do you recommend for a low-budget beginner?

Would love to hear your experiences and any lessons learned. Thanks!

My person running my local social dance community's website has expressed his desire to hand-off the domain, and the website itself is old and convoluted and cannot be transferred, so I'm building a new one on WordPress, and doing my best to replicate the important functions of the old website. My skilllevel with WordPress is mixed as I've built multiple websites using existing themes and plug-ins before but I'm not fluent in which tools are best for what purpose and it's been a minute since I last did it.

This is a little hard to articulate because I'm not sure what all of the functions are that I need or what the different ways to accomplish the same set of goals are. But on the old website, there was a frontend login and only specific people were given accounts. Once logged in, you could choose the category of event you wanted to post, you'd input time, date, venue etc, you'd get a text-editing window to put event details with basic formatting and a photo, and once published, the info about the event would post under the correct category of event. Most events were recurring so they'd stay visible until the creator or the website admin removed them, but special events would expire when the date had passed. The recurring events could be edited at any time by the users who posted them and some users edit them frequently. The "posting" ability was never used for news or updates, the way a blog post would typically be.

I found UsersWP for the front-end log-in and posting capability but there were a few things I was uncertain about:

1. Would this allow me to limit *who* could register as a user? It's very important that only known local event organizers specific to this community can use the site to post their events.

2. Is a "post" the closest equivalent out there for what i've described above for listing and editing the events? Or is there some kind of form submission that would allow the contents to be published without a human having to go add it to the page that could give me more control over what info had to be included (venue, time, date, etc)? Would a form submission still be editable by the users later on?

3. Can these posts or form submissions be automatically sorted into different categories (ex: dances, classes, special events) with existing filters or is that another plug-in? Similarly, is it possible to set some of the posts to "expire" or no longer be visible past a specified date?

If someone would be up for helping me pick apart the functions I need and which tools accomplish that, I'd really appreciate it!

So long story short I migrated my website form Shopify to Wordpress and then initially it was almost 75 for mobile and 90 for PC.
So naturally i optimized it and no it is 40-60 for mobile and 80 for PC.
Here is what I did:
(My product pages are most bad in this.)
1. I did changed the format of images to webp (using Webp optomizer ) and when I used elementor then it really went down.
2. When I use searched online I almost did all of the things.
3. Using JS and CSS minify only decrease the speed drastically.
4. Using lazy load my speed is also very bad.
5. I used custom php to exclude the hero and other first load images form the lazy load.
6.I did all the cahce setting in litespeed chache and still nothing.
7. My most bad thing is LCP and FCP.
8. I also disabled the fonts which were additional.
I also have a bit more then average CSS and a bit JS in my site.
Can you please hepl me in this regard.
here are some screenshots.
And using VPI and lazy load really cause it to slow.
can someone at least tell me some tool to diganost the problem

EDIT: When we run ads the it's almost a 10sec delay to website Soo also bad

Hello experts,

we have had an opencart store since 2012, 32k products and database is keep building.

We are thinking of migrating to WP but number of reasons

1 - setup a corporate website for lead generation

2 - setup shop on subdomain

What are your honest thoughts of this move?

​

Hey everyone,

I'm setting up a fresh WordPress site with the Twenty Twenty-Five theme and I'm stuck on publishing a page. Hoping someone here has run into this before and can point me in the right direction.

The setup:

Fresh WordPress install, Twenty Twenty-Five theme

Creating a new page, selecting a pattern (following the official tutorial)

Clicking "Publish" gives me:

Publishing failed. Could not update post in the database.

Are you ready to publish? Double-check your settings before publishing.

In the browser console (F12 → Network), the actual culprit is an HTTP 500 Internal Server Error.

Affected URL (anonymized): https://my-site.com/wp-admin/post.php?post=XXX&action=edit

What I've already tried / ruled out:

Permalinks reset (Settings → Permalinks → "Post name" → save). No change.

All plugins disabled temporarily. Error persists – so it's not a plugin conflict.

Site Health: No critical issues, only 5 "recommended improvements" (inactive plugins/themes, missing opcode cache, no page cache detected, server response time OK). The REST API is not flagged as broken there.

It's a brand-new, empty page using a default pattern – no legacy content, nothing exotic.

My suspicion:

Since everything on the WordPress side looks clean, I'm leaning toward a server-side issue. The 500 hits exactly when the editor tries to write the page to the database via the REST API (/wp-json/...).

Questions for the hive mind:

Has anyone seen this behavior with Twenty Twenty-Five (or Block Editor + patterns in general)? What was the root cause?

Which server-side settings should I check first? I'm thinking:

PHP error log / debug.log

Firewall / ModSecurity / WAF blocking POST requests to /wp-json/

Cloudflare (if in front) – Bot Fight Mode / security rules

WP_MEMORY_LIMIT / max_execution_time

Database charset (collation) – utf8mb4 vs. utf8

Is there a way to export the Site Health report (e.g. as a file) to hand off to the host/admin? I've only found the dashboard view so far.

Any known workaround to publish the page in the meantime (e.g. Classic Editor as a stopgap)? I know that's just a band-aid, not a fix.

I've already reached out to the backend/server admin to check logs and the firewall. But if anyone here has hit this exact error, I'd love to hear what solved it.

Thanks in advance!

UPDATE: Blank page also fails with 500 – so it's not the pattern

Hey everyone, thanks for the quick replies – all three were genuinely helpful. Quick update since a few people asked for follow-up:

What I tested based on your suggestions:

Blank-page test (u/CombinationParty7358 – the first reply): Tried publishing a completely empty page, no pattern, no content. Same 500 error. So it's not weird Unicode characters in the pattern – it's something more fundamental in the write path. Good call, that narrowed it down a lot.

debug.log before ModSecurity (u/Jealous-Machine-5192 Took your advice and prioritized the PHP log over the ModSec rabbit hole. I've asked the server admin to pull wp-content/debug.log and the PHP error log around the timestamp of the failed publish. Will update once I have the output.

DB charset (u/ – answer b): This is now my top suspect given the blank-page result. Asked the admin to verify:

define('DB_CHARSET', 'utf8mb4'); in wp-config.php

tables actually on utf8mb4_general_ci / utf8mb4_unicode_ci (not just utf8)

Will report back if that's the culprit – your "exact same thing last month" story is very much on my mind.

Site Health export: Found it – Tools → Site Health → Info gives the raw dump to copy. No export button, as you said. Thanks for the pointer.

Classic Editor workaround: Keeping it in my back pocket. If we need the page live short-term, I'll activate it as a stopgap – but I'd rather fix the real cause first.

Current status: Waiting on the server admin's log output. The blank-page result makes me lean even more toward a server-side write/permission/DB issue rather than anything content-related. Will post the final solution here once we've nailed it – so the next person with this error has a reference.

Thanks again, this sub is great.

Update:title: [Update] My "500 on every publish" wasn't a DB-schema issue after all — it was a MySQL tmpdir problem on the server

A while back I posted here asking whether a DB-level fix (SQL) for a 500-on-every-publish error was legitimate, or whether I'd just be masking a deeper issue. Got some great input — here's the follow-up, because the answer turned out to be neither of the things I expected.

Original problem:

Fresh WP install, Twenty Twenty-Five theme

New page + pattern → "Publishing failed. Could not update post in the database."

Console: HTTP 500 on the REST API call

A completely blank page also failed ← the key data point

Permalinks reset, all plugins disabled → no change

The DB suspects (from this thread and others):

wp_posts.ID missing AUTO_INCREMENT

Charset mismatch (utf8 vs utf8mb4)

What it actually was: The server admin found this in the MySQL error log:

text Can't create/write to file '/var/tmp/mysql.QTwenq/MLut5EBo' (OS errno 2 - No such file or directory) MySQL couldn't create a temp file for the UPDATE query because the tmpdir path was missing / not writable. That's why every write failed — including a blank page. Neither AUTO_INCREMENT nor charset had anything to do with it.

The frustrating part: after the first tmpdir fix, the error became intermittent — sometimes publishing worked, sometimes it didn't. Still chasing that down (checking tmpdir persistence, cleanup processes, and PHP resources like memory_limit / max_execution_time).

The "-2" URLs (/345-2/, /123-2/) and the leftover drafts? Normal WordPress behavior — they actually prove writes were partially succeeding. The DB was never fully blocked, just flaky.

My takeaway for anyone hitting "500 on every write":

Check the server logs first (MySQL error log, PHP error log) — before touching DB schema or plugins. The tmpdir error was sitting there the whole time; I just didn't have access.

A DB-schema "fix" would have masked the real problem here, not solved it. So my original question was the right one to ask — but the answer was "neither: it's infrastructure."

If it's intermittent, think resource/timing issue (disk space, permissions, timeouts), not a structural defect.

Will post a final update once the intermittent failures are fully gone. Thanks again to everyone who pushed me toward the logs instead of guessing.

Greetings ☺️

Rank Math Pro version was apparently impacted by a supply chain attack affecting some users who had recently updated the plugin. Rank Math has a write up on their site that users may wish to review. WordFence provided the following summary:

Rank Math SEO PRO 3.0.123 - Unauthenticated Embedded Malicious Code (9.8, Critical)

Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC. Rank Math states that the affected plugin files contained malware that could compromise a website if the plugin was activated and directs sites that activated an affected package to treat the website as compromised. The malware may establish persistent access, communicate with rank1cdn[.]com, recreate hidden backdoors on page visits, and expose WordPress credentials, database credentials, API keys, and other secrets accessible to the web server. Rank Math identifies three malicious wp_options keys, hidden PHP backdoors, unauthorized administrator accounts, a fake WordPress core file, PHP-executable .cache files, and a system cron marker as incident indicators. Only packages obtained during the vendor-confirmed window are claimed as affected; version 3.0.123 alone is not sufficient to establish compromise. Rank Math removed the affected files and released version 3.0.124 as the clean replacement.