In the last week, three different WordPress plugins were caught being actively exploited by attackers in the wild. Not theoretical “could be exploited.” Actually being used, right now, to break into real websites.
The plugins:
- Ninja Forms, a contact form plugin running on more than 800,000 websites
- Kali Forms, another popular form builder
- Perfmatters, a performance optimization plugin used by tens of thousands of sites that care about speed and SEO
If your website uses WordPress (and roughly 43% of the internet does), there is a real chance you are running at least one of these. And if you are, and you have not updated in the last few days, the front door of your website may be sitting wide open.
This isn’t a piece written to scare you. It’s a pattern worth understanding, because what happened this week is not a one-off. It’s the new normal, and there’s a simple way to stay ahead of it.
What attackers actually do once they get in
When most people picture a “hacked website,” they picture some movie scene with stolen credit cards. That’s almost never what happens. The reality is more mundane, more annoying, and more damaging to your business and your reputation. Once attackers get in through a vulnerable plugin, here’s what they typically do:
- Deface the site. Visitors arrive at your homepage and see something that isn’t yours: a political message, a hacker’s signature, sometimes just a broken page. It looks unprofessional and embarrassing, and your customers see it before you do.
- Take the site offline. Sometimes the attacker’s actions (or just the security tools reacting to them) break the site entirely. Every minute it’s down is a minute people can’t book, buy, or contact you. They go to a competitor instead.
- Use your site to send spam. Your domain gets hijacked into sending thousands of spam emails. Within days, your domain is on email blacklists, which means your real emails (invoices, replies to customers, newsletters) start landing in spam folders, or never arriving at all. Repairing email deliverability after this is slow and painful.
- Inject SEO spam. Attackers add hidden links, pages, or redirects to your site that point to gambling, pharmacy, or scam content. Google notices. Your rankings collapse, and in many cases your site gets flagged in search results with a “This site may be hacked” warning. Recovery from a Google penalty takes weeks.
- Add malicious redirects or host phishing pages. Visitors who click your site get sent to a phishing page or a scam, often only on certain devices or referrers (so you might not notice for days). Or your site silently hosts phishing pages targeting other people’s customers, with your domain attached to the attack.
- Distribute malware. Some compromises quietly serve malware to your visitors’ browsers. Once Google or browser vendors detect this, your site shows the bright red “Deceptive site ahead” warning, and roughly nobody clicks through that screen.
Notice what most of these have in common. The damage isn’t necessarily to data on your server. It’s to your domain’s reputation, your search rankings, your email deliverability, and your customers’ trust. Those are slow to repair, and in some cases (a lost top Google ranking, a domain blacklisted for spam) the damage is hard to undo at all.
Why this is happening more in 2026
There are now over 60,000 plugins in the WordPress ecosystem. Most are built by small teams or solo developers, and many haven’t been meaningfully updated in years. Attackers know this. So they’ve gotten very efficient at scanning the entire internet for known vulnerable plugins and exploiting them within hours of a new flaw being publicly disclosed.
The trend through 2026 has been:
- Faster disclosure-to-exploitation. It used to take weeks for attackers to weaponize a new vulnerability. Now it’s often hours.
- More plugins under the microscope. Security researchers (Patchstack, Wordfence, and others) are auditing more plugins than ever. That’s a good thing, but it also means more flaws are surfacing every week.
- Automated, untargeted attacks. Attackers don’t care who you are. They scan the entire internet and break into whatever’s vulnerable. A small local business is just as much a target as a large company.
In other words: WordPress sites that don’t get regular maintenance are getting picked off faster than ever before, regardless of how small or “boring” the business is.
What you should actually do
You don’t need to become a security expert. You need a small set of habits, or someone managing them for you. Here’s the short list:
- Keep WordPress core, themes, and every plugin up to date. This single habit prevents most of the problems above. The patches for the three plugins exploited this week were already available, and sites that updated weren’t affected.
- Remove plugins you don’t actually use. Every active plugin is attack surface. If a plugin is installed but disabled, uninstall it completely. If you don’t remember why a plugin is on the site, that’s a sign it shouldn’t be.
- Have a real backup, and confirm it actually restores. A backup you’ve never tested is a hope, not a plan. You want backups stored off the web server, taken at least daily, and verified to actually work.
- Use a security plugin or a web application firewall (WAF). Tools like Wordfence and Patchstack catch known attack patterns even when a plugin you use turns out to be vulnerable. They’re not foolproof, but they buy you time between when a vulnerability is disclosed and when you can patch.
- Limit who has admin access. Most small business sites have far too many admin accounts left over from old contractors, ex-employees, and one-off projects. Audit them. Remove anyone who doesn’t actively need access this month.
That’s it. Five habits. None of them are exotic, and together they prevent the overwhelming majority of what we see go wrong on small business WordPress sites.
If you’d rather just have someone handle this
This is exactly the kind of work that’s easy to forget about until it’s too late, which is why we offer a managed maintenance plan that handles all five points above for you, every week. Updates, backups, security monitoring, and a quick email if something needs your attention. If you’re tired of wondering whether your site is one outdated plugin away from a bad week, get in touch and we’ll walk through what your site actually needs.
The good news about WordPress security in 2026 isn’t that the threats are smaller. It’s that the basics still work. The sites that get hit are almost always the ones that haven’t done the basics in a while.
Don’t be that site.
