I know. That's not what we've been telling everybody for years.

But a new one making the rounds is a good reminder that sometimes the problem isn't an outdated plugin.

Sometimes the attacker is holding something your site already trusts.

Here's what's being reported. Starting around October 18, attackers were sending commands through UpdraftCentral, the remote management side of UpdraftPlus, and using them to install malicious plugins on WordPress sites.

The commands were passing authentication. That's the part that got my attention.

It doesn't look like a typical "vulnerable plugin" hack. It looks like the attacker got their hands on legitimate management keys.

So you could have:

- WordPress updated

- UpdraftPlus updated

- Strong passwords

- Nothing obviously wrong

…and still have someone installing malware on your site.

:: Updating may not fix it.

Normally my first question is "Is there a patch?" Here, a patch may not cancel a key the attacker already has.

If you use UpdraftCentral, the safest move right now is to disconnect the existing connection until the vendor gives clear guidance. Your regular backups aren't affected by that.

:: Don't trust the Users screen alone.

The malware can create an account that looks like a plain Editor while quietly holding extra admin powers. If you're only hunting for a new "Administrator," you could walk right past it. [hint]

Once a site is compromised, I don't take WordPress's word for what's going on. I want to see the database and the files. The dashboard is helpful, but it isn't evidence.

:: The bigger lesson:

Our sites now connect to backup tools, management dashboards, CDNs, email services, payment systems and, more and more, AI tools. Every one of those trusted connections is another door.

And sometimes the attacker doesn't pick the lock. They steal the key.

If anything on your site has acted strangely since October 18, have someone look at it. Updating the plugin won't remove malware that's already in.

And treat any outside service that can change your site remotely like you'd treat an admin password.

⚠️ WordPress 7.1.3 is now available and fixes 7 security vulnerabilities in WordPress Core, along with 4 additional bugs.

The most important fixes include:

🔹 Stored XSS through pending comments
Malicious code could potentially run when an administrator opens the Comments moderation screen.

🔹 SQL injection in the WordPress export system
Malicious input could remain hidden until someone runs a WordPress export.

🔹 Private comments exposed
Comments on private or unpublished posts could potentially be viewed by visitors who were not logged in.

🔹 Additional fixes
WordPress also patched an Imgur embed XSS issue, a denial-of-service bug, and several permissions-related vulnerabilities.

Interestingly, Anthropic reported 3 of the 7 vulnerabilities, with others reported by Trail of Bits, Patchstack, independent researchers, and the WordPress security team.

There are currently no known reports of these 7.1.3 vulnerabilities being actively exploited.

Still, I recommend updating sooner rather than later.

✅ Update WordPress Core to 7.1.3
✅ Confirm your backups are current
✅ Check older WordPress installations carefully, since some security fixes are still being backported

If automatic Core updates are enabled, your site may already be updated. See:
Dashboard → Updates

Stay patched!