A WordPress plugin on your site has a known vulnerability
Security researchers publish plugin flaws every week and attackers scan for them within hours. If a plugin on your site is listed, update to the fixed version today. If there is no fix, disable the plugin.
- Difficulty
- medium
- Time
- about 20 minutes
- Last reviewed
- 2026-10-26
Is this urgent?
Today. If the alert says attackers are already using it, now.
Easy fix, no technical skills
Open Plugins in WordPress admin. If an update is available for the named plugin, back up and update it.
If no fix exists yet, deactivate the plugin until one does.
Look for signs of a break-in: unknown admin users (Users), new pages or posts you did not write, and visitors reporting redirects.
Change the WordPress admin password and, if the plugin handled payments or logins, the related passwords too.
Hand it to your IT person
Copy this into an email or chat. Replace the brackets with the details from your alert.
Plugin (slug) version (version) on example.com has (CVE or advisory). Fixed in (version) if known. Please update or disable it, check for indicators of compromise (unknown users, modified files), and consider a malware scan.
Technical fix (commands)
Update one plugin.
wp plugin update plugin-slug wp plugin deactivate plugin-slug
Check core files and look for recent changes.
wp core verify-checksums find wp-content -type f -mtime -2 -name '*.php'
List users with admin role.
wp user list --role=administrator
Check it worked
The plugin version is at or above the fixed version; our vulnerability page for it shows no open issue.
Scan the site for outdated plugins with the free tool. All free tools.
Prevent it next time
- Fewer plugins, updated promptly.
- A web application firewall (your host's or Cloudflare's).
Common questions
Is this urgent?
Today. If the alert says attackers are already using it, now.
Can I fix this without technical skills?
Yes. The easy fix below needs no technical skills; the commands are only for your IT person.
How long does it take?
About 20 minutes once you know who runs the website.
Hear about this before your customers do
Add your website and we check uptime, certificates, domains and email security for you, free.