WordPress update fixes code injection flaw, exploitation attempts observed

What happened

On 30 October 2026, WordPress released updates that close several vulnerabilities. One of them allows attackers to inject malicious code. According to the report linked below, exploitation attempts against this flaw are already being observed.

No CVE identifier or severity score was available in the information we received. The source data also does not list the exact affected or fixed versions. Please check the official WordPress release announcement and the report linked below for the version numbers that apply to your branch.

Who is affected

Operators of WordPress websites that have not yet installed the latest security update. This includes sites run for customers, multisite networks and staging copies that are reachable from the internet. Sites where automatic background updates for core are disabled or have failed are at particular risk.

What to do now

1. Make a quick backup of the site files and the database, or confirm that a recent backup exists.
2. Check the official WordPress release announcement for the fixed version of your branch.
3. Update WordPress core, either in the dashboard under Dashboard > Updates or with WP-CLI: wp core update followed by wp core update-db.
4. If you manage many sites, update all of them, including staging and forgotten installations. With WP-CLI you can check each site with wp core version.
5. Confirm that automatic updates for core are working, so that future security releases are installed promptly.
6. Load the front end and the admin area of each site to make sure everything works after the update.
7. Update plugins and themes at the same time, as they are a common additional entry point.

How to check whether you are affected or were hit

• Run wp core version and compare the result with the fixed version from the WordPress announcement.
• Run wp core verify-checksums to detect modified core files. Any unexpected changes in core files are a warning sign.
• Review the list of administrator accounts (wp user list --role=administrator) for users you do not recognise.
• Look for recently changed or new PHP files, for example in wp-content/uploads, where PHP files normally do not belong: find wp-content/uploads -name "*.php".
• Check installed plugins and themes for entries you did not install yourself.
• Review the web server access logs for unusual requests, such as many POST requests to unexpected URLs or requests from unknown IP addresses around and after 30 October 2026.

If you find signs of compromise, take the site offline or restrict access, restore from a clean backup made before the intrusion, update everything, and change all administrator, database and hosting passwords as well as the secret keys in wp-config.php.

Sources

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.heise.de/news/WordPress-Update-stopft-Schadcode-Luecke-Exploit-Versuche-beobachtet-11505811.html