What is happening? The latest WordPress hack news in 2026

Short answer: Since July 2026, hackers have been attacking bugs in WordPress core and in several very popular plugins. If your site got hacked recently, one of the five events below is a likely reason.

We read the reports from security companies and news sites. Here is a simple log of what happened, with dates, and what you should do for each one.

The lesson from all five stories is the same. The fix was ready, but many sites did not update in time. Hackers moved faster than site owners.

Why are so many WordPress websites getting hacked?

Short answer: WordPress runs a very large part of the web, so hackers build robots that scan every WordPress site for known bugs. They do not pick your site by name. They pick it because it has an old plugin.

Five hours is very short. If you update plugins once a month, your site can stay open to attack for weeks. This is why so many sites were hit this summer.

The main reasons sites get hacked

• Old plugins and themes. This is the number one reason. Most WordPress bugs are in plugins, not in WordPress itself.
• Weak or reused passwords. Robots try millions of passwords on /wp-login.php every day.
• Nulled (pirated) themes and plugins. Free copies of paid plugins often have malware inside.
• Too many admin users. Old staff, old agencies and old freelancers still have full access.
• Cheap shared hosting. One hacked site on the server can infect the others.
• No firewall and no backups. So nothing blocks the attack, and there is no clean copy to go back to.

There is one more change in 2026. Patchstack and Monarx found that hackers now hide their code inside real WordPress, plugin and theme files. They no longer drop one clear bad file. So the old way of “scan and delete” misses a lot. A proper cleanup must compare every file with the original.

How do I know if my WordPress site is hacked?

Short answer: Look for sudden redirects, new admin users, a Google warning, strange pages in search results, or a fall in traffic. If you see even two of the signs below, act now.

1. Your site sends visitors to another site. Often a casino, pills or fake prize page. It may happen only on mobile, or only for visitors from Google.
2. Google shows “This site may be hacked” or Chrome shows a red “Deceptive site ahead” screen.
3. New admin users that you did not create.
4. Japanese or Chinese text in Google results for your site. This is the Japanese keyword hack.
5. Hundreds of new pages in Google Search Console that you never made.
6. You cannot log in, or your password stopped working.
7. The site is very slow or the server uses 100% CPU.
8. Your host suspended the account for malware or spam email.
9. Strange files with names like wp-sec.php, wp-vcd.php, class-wp-cache.php or random letters.
10. Pop-ups or ads you did not add.
11. Emails from your site go to spam, or customers get emails you did not send.
12. Google Ads stopped your ads for “malicious software”.

What are the common types of WordPress hacks?

Short answer: Most hacks fall into eight types. Knowing the type tells you where to look.

How to fix a hacked WordPress website in 12 steps

Short answer: Back up, scan, lock the doors, replace all code with clean copies, remove backdoors, clean the database, update, harden, and ask Google to check again. Do the steps in this order. Do not skip any.

1. Stay calm and do not delete things yet

   Do not start deleting files in a hurry. You may remove proof of how the hacker got in. Turn on a maintenance page so visitors do not get harmed. If your site takes payments, turn off checkout for now.

2. Take a full backup of the hacked site

   Yes, back up the hacked site too. Download all files and export the database. Keep it on your computer, not on the server. If something goes wrong in the cleanup, you can go back. It also helps you find the entry point later.

3. Scan the site for malware

   Use more than one scanner, because each one finds different things.

   • Wordfence or a similar security plugin for a deep file scan
   • Sucuri SiteCheck for an outside scan
   • The malware scanner in your hosting panel
   • Google Search Console for Security issues

   Write down every file and URL the scanners report.

4. Change every password and log out all users

   Change passwords for WordPress admins, hosting panel, FTP or SFTP, database and your email. Use long, new passwords. Then change the secret keys (salts) in wp-config.php. This logs out everyone, including the hacker.

   wp config shuffle-salts

   No WP-CLI? Get new keys from the WordPress.org secret key tool and paste them into wp-config.php.

5. Remove unknown users

   Go to Users, then All Users, then filter by Administrator. Delete any admin you do not know. Also open the wp_users table in phpMyAdmin. Some hackers hide their user from the dashboard, but it still shows in the database.

6. Replace WordPress core with a fresh copy

   Do not try to clean core files one by one. Replace them. Delete the wp-admin and wp-includes folders and upload fresh ones from WordPress.org. Keep wp-content and wp-config.php. With WP-CLI you can also check every core file against the original:

   wp core verify-checksums
   wp core download --force --skip-content

7. Reinstall every plugin and theme

   Delete each plugin folder and install a fresh copy from the official source. Do the same for your theme. If you have a child theme with custom code, check each file by hand. Remove every plugin and theme you do not use. Remove every nulled plugin. This step matters most in 2026, because hackers now hide code inside real plugin files.

   wp plugin verify-checksums --all

8. Hunt for backdoors

   A backdoor is a small hidden file that lets the hacker come back after you clean up. This is why many sites get hacked again after one week. Check these places:

   • /wp-content/uploads/ should have images and documents. It should not have PHP files.
   • /wp-content/mu-plugins/ loads on its own and does not show in the plugin list.
   • wp-config.php, .htaccess, index.php and your theme’s functions.php.
   • Cron jobs in your hosting panel and in WordPress.

   # find PHP files where they should not be
   find wp-content/uploads -name "*.php"
   
   # find files changed in the last 15 days
   find . -type f -name "*.php" -mtime -15
   
   # look for common malware code
   grep -rlE "eval\(|base64_decode\(|gzinflate\(|str_rot13\(" wp-content

   Not every result is malware. Some real plugins use these functions. But every result needs a look.

9. Clean the database

   Malware also lives in the database. Check these:

   • wp_options: are siteurl and home correct? Any strange long values?
   • wp_posts: search for <script, <iframe and unknown domains.
   • Spam posts, spam pages and spam comments made by the hacker.
   • Unknown entries in wp_usermeta that give admin rights.

10. Update everything and close the hole

    Update WordPress core, all plugins, all themes and PHP. Check the safe version table below. If you do not fix the hole, the same robot will hack you again in a few hours.

11. Harden the site

    Now make it hard to get in again. Add two-factor login for all admins. Add a web application firewall. Limit login tries. Turn off the file editor in the dashboard. Block PHP from running in the uploads folder.

    // add to wp-config.php
    define( 'DISALLOW_FILE_EDIT', true );

    # add to /wp-content/uploads/.htaccess (Apache)
    <FilesMatch "\.(php|phtml|php7|phar)$">
      Require all denied
    </FilesMatch>

    That one rule would have stopped the Elementor Pro and WooCommerce file upload attacks from running their code.

12. Ask Google to review, then watch for 30 days

    When the site is clean, ask Google to check it again. See the next section. Then scan the site every day for one week, and every week for one month. If the malware comes back, a backdoor is still hiding somewhere.

Which versions are safe? Check these on your site today

Short answer: If any item below is older than the safe version, update it now and then scan your site. Updating closes the hole, but it does not remove a hacker who is already inside.

Version data is from SecurityWeek, BleepingComputer, TechCrunch and Wordfence reports, checked on 18 September 2026. New fixes come out often, so always install the newest version.

How do I remove the “This site may be hacked” warning from Google?

Short answer: Clean the site fully first. Then open Google Search Console, go to Security issues, and click Request review. Google usually answers within a few days.

1. Make sure the site is 100% clean. If Google finds malware again, the next review takes longer.
2. Open Google Search Console and pick your site.
3. Go to Security and Manual Actions, then Security issues.
4. Read each issue and the sample URLs. Check that each one is fixed.
5. Click Request review. Write in simple words what was wrong and what you did. For example: “Removed backdoor files, replaced all core and plugin files, changed all passwords, updated all plugins.”
6. If your site is on other blacklists, such as your antivirus or hosting blacklist, ask each one for a review too.

If Google Ads stopped your ads, open the policy issue in your Ads account and ask for a review after Search Console shows no issues.

What does a hack do to my SEO, and how do I get my traffic back?

Short answer: A hack can drop your traffic fast, because Google shows warnings and indexes spam pages under your name. After a full cleanup, most sites get their rankings back in a few weeks.

How a hack hurts your rankings

• Google shows a warning, so fewer people click.
• Thousands of spam pages get indexed on your domain.
• Spam links point from your site to bad sites.
• The site gets slow, so users leave.
• Redirects send your visitors away before they read anything.

How to recover your traffic

1. Return 410 for spam URLs. A 410 code tells Google the page is gone for good. It is faster than 404.
2. Send a clean sitemap. Delete any fake sitemap the hacker made. Submit your real one again in Search Console.
3. Check robots.txt and .htaccess. Hackers often edit these to show spam only to Google.
4. Use URL Inspection on your top pages and click Request indexing.
5. Use the Removals tool for the worst spam URLs, so they leave search results quickly.
6. Check your titles and meta descriptions. Make sure the hacker did not change them.
7. Watch the Pages report each week until the spam pages are gone.

This matters for AI search too. Tools like Google AI Overviews, ChatGPT and Perplexity read your pages to answer people. If your pages show spam text or a security warning, these tools will stop using your site as a source. A clean, fast and trusted site is the base for SEO, AEO and GEO.

How do I secure my WordPress site after the cleanup?

Short answer: Update fast, use strong logins, add a firewall, keep backups off the server, and check the site every week. Basic security habits stop most attacks.

• Turn on auto-updates for plugins and minor core releases.
• Check for updates at least two times a week. Remember the 5 hour window.
• Use two-factor login for every admin and editor.
• Use a password manager. No shared or reused passwords.
• Give each person the lowest role they need. Remove old users.
• Add a web application firewall, such as Cloudflare, Wordfence or Sucuri.
• Limit login tries and change or protect the login URL.
• Turn off XML-RPC if you do not use it.
• Block PHP in the uploads folder.
• Turn off the dashboard file editor.
• Set file permissions to 644 for files and 755 for folders. Set wp-config.php to 600 or 640.
• Delete plugins and themes you do not use. Inactive plugins can still be hacked.
• Never use nulled themes or plugins.
• Keep daily backups in a different place, such as cloud storage. Test a restore every few months.
• Use good hosting with site isolation, SFTP and a current PHP version.
• Use SSL on every page.
• Set up uptime and malware alerts, so you know in minutes and not in weeks.

Should I fix the hack myself or hire a WordPress malware removal expert?

Short answer: You can fix a small hack yourself if you are good with files and databases. Hire an expert if the site makes money, holds customer data, keeps getting hacked again, or is blocked by Google.

One more tip. If you have many sites on the same hosting account, clean all of them at the same time. Malware jumps from one site folder to the next. Cleaning only one site does not work.

Sources

• TechCrunch, 20 July 2026: hackers attack newly fixed WordPress core bugs
• WordPress.org: WordPress 7.0.2 security release
• BleepingComputer, September 2026: Elementor Pro bug used to take over sites
• SecurityWeek, September 2026: Elementor Pro CVE-2026-32475
• SecurityWeek, 3 September 2026: All-in-One WP Migration CVE-2026-19949
• Check Point Research, 2026: thousands of hacked WordPress sites in one operation
• Patchstack, State of WordPress Security in 2026 (bug counts and the 5 hour attack window)