A backup plugin installed on more than three million WordPress sites had a flaw serious enough to hand an attacker the entire site — not just the backups. The company that found it published a fix right away. Two weeks later, most sites running the plugin still hadn't installed it. If you have a WordPress site, or aren't totally sure who's keeping yours updated, this is worth five minutes of your time.
What actually happened
In early September 2026, the security firm Wordfence disclosed a flaw in All-in-One WP Migration and Backup, a plugin used on an estimated 3+ million WordPress sites to move sites between hosts and take backups. The flaw let an attacker, in the right circumstances, take over a site completely — turning a tool meant to protect your site into a way in.
The plugin's developer had actually already fixed it — a patched version shipped in mid August, before the public disclosure. But as of early September, roughly two out of every three sites running the plugin were still on the older, vulnerable version. That gap — a fix that exists but hasn't been installed — is the part of this story that matters most, because it isn't specific to this one plugin.
Why a two-week-old fix is still a problem
It's tempting to hear "the developer already fixed it" and file this away as someone else's problem. But a fix only protects a site once it's actually installed, and installing plugin updates is exactly the kind of small, easy-to-postpone task that quietly never happens — especially on a site nobody logs into unless something looks broken.
That's the real lesson here. It's not "avoid this particular plugin." It's that a website's software needs upkeep the same way a storefront needs a lock checked and a security system serviced — not a one-time setup, but a recurring job with someone's name on it. A WordPress site typically runs a dozen or more plugins, any one of which can develop a flaw like this one. The fix existing doesn't help you if nobody's job is to apply it.
What to check on your own site this week
- Does your site even run WordPress? If a previous freelancer, agency, or a DIY build used WordPress, this applies to you. If you're not sure, ask whoever built it.
- Is there a plugin update waiting? Logging into the WordPress dashboard shows a number next to "Updates" if anything is outstanding — plugins, themes, or WordPress itself.
- Is anyone actually checking that screen? A number sitting there for weeks or months means the honest answer is no — which is worth knowing either way.
- Is the site backed up somewhere separate from the site itself? If a plugin flaw like this one were ever used against your site, a recent, working backup is what turns a disaster into an inconvenience.
None of this requires becoming technical. It requires five minutes, or a two-line message to whoever manages your site asking them to check.
Whose job is this, actually?
This is the question worth actually getting a straight answer to, because "hosting" gets used to mean very different things. Plenty of hosting plans — ours included — keep the server online, patched, and backed up, but explicitly don't cover updating the software running on top of it, like a brought-in WordPress site's plugins and themes. That's not a hidden gotcha; it's a genuinely different, more hands-on job, and it's usually priced and sold separately for good reason. If you've never had that conversation with whoever hosts your site, it's worth having.
Our own business websites aren't built on WordPress, so this specific plugin problem doesn't apply to them the same way — but the underlying idea does: a site is only as secure as whoever's actually maintaining it, which is why security updates, backups, and monitoring are handled as an ongoing part of the service, not a box checked once at launch. If you have an existing WordPress site and want an honest read on whether it's actually being kept up to date, that's a conversation we're happy to have even if the answer is "you're fine, keep doing what you're doing."
A plugin update is a small thing until the week it isn't. You don't need to track every security disclosure that comes out — you just need to know, with a real answer, who's checking for the ones that matter.