Log into your WordPress dashboard right now and open the Plugins page. Count how many say “update available.” Then ask yourself the harder question: how long has that update actually been sitting there?
Most people expect the worst case to be something embarrassing. A funder spots an old page. A form goes quiet. On 9 July 2026, Australia’s own cyber security agency published an alert that shows the real worst case looks nothing like that.
What actually happened in July
ASD’s Australian Cyber Security Centre found attackers running a large-scale, automated campaign against websites worldwide, including plenty here in Australia. They weren’t breaking new ground. They were scanning for specific, already-known holes in specific, named WordPress plugins, several of them genuinely mainstream software, not obscure add-ons: Gravity Forms, Ninja Forms, ACF Extended, WPvivid Backup, among others. Wherever they found a site still running the vulnerable version, they planted a webshell, a quiet backdoor that lets an attacker keep coming back and controlling the site, even after the original hole eventually gets patched.
Every one of those holes already had a fix available. That was ASD’s whole point in publishing the alert: this wasn’t a mystery zero-day nobody could have prevented. It was a list of known, patched vulnerabilities, sitting there unapplied on real Australian websites.
The patch existed. Nobody applied it.
That campaign has a name now too: WP-SHELLSTORM. In June, before ASD’s alert even went out, security researchers at SOCRadar and Ctrl-Alt-Intel found the attackers’ own server sitting exposed online, unprotected by so much as a password, and got a genuine look at the real scale behind it. 1.4 million websites were on the target list. 25,195 showed confirmed evidence of actually being compromised. A single bug in one caching plugin accounted for more than 17,000 of those on its own.
There’s no confirmed count yet of how many were Australian specifically. But WordPress runs a large share of Australian small business and non-profit websites, so treating this as something that only happened somewhere else isn’t a safe assumption.
And as some perspective, ASD publish 2-3 alerts like this every month.
Why it’s almost always the plugins
Patchstack, a company that tracks WordPress security professionally, logged 11,334 new vulnerabilities across the WordPress ecosystem in 2025. 91% of them were in plugins. Themes accounted for another 9%. WordPress core itself, the actual software running the site, accounted for fewer than 6, comfortably under 0.1%.
That’s worth sitting with. Keeping WordPress updated is good practice, but it’s barely where the real risk lives. The risk sits in whichever of the dozens of plugins a site has accumulated over the years, plenty of which nobody remembers installing, let alone checking.
Updating isn’t even a complete answer on its own. Close to half the vulnerabilities Patchstack tracked had no developer fix available yet at the point they were publicly disclosed. Sometimes there’s genuinely nothing to click “update” on. The only real defence at that point is knowing it’s happened and reacting fast, not waiting on a patch that might not exist.
How to actually stay on top of it
If you’re managing this yourself, two things matter more than anything else. Check the plugin list on a set schedule, at least once a month, and actually action what needs updating instead of dismissing the same notification for the fourth month running. It’s also worth keeping half an eye on ASD’s own alerts. They land more often than most people expect, and the goal is to hear about something like the July alert quickly, before it’s old news everywhere else.
Plugin updates are one part of a longer list. If you want the fuller picture, backups, admin account hygiene, and everything else worth checking, RBT’s own website maintenance checklist walks through it.
Or let a website maintenance package handle it
The other option is to have someone doing this as a matter of course. When ASD published the July alert, every one of RBT’s Website Care Plan clients had their site checked against it within days, without anyone having to ask. That’s simply what an actual website maintenance package is supposed to do: security updates applied and checked by hand, plugins triaged before they become an entry point, and a plain-English report telling you what was found.
That’s part of the same baseline covered by every tier of RBT’s Website Care Plans, starting with Maintain at $79 a month.
What this actually costs, compared to cleaning up after the fact
Here’s the honest comparison, because “better safe than sorry” isn’t a number either. Once a site’s actually compromised the way the July campaign compromised real ones, rebuilding a few broken pages is the easy part. Someone still has to audit for what got left behind, since a changed password doesn’t necessarily remove a backdoor. Then there’s the harder cost: explaining to a board, a funder, or the community you serve, why your own website was the thing that put them at risk.
$79 a month to have someone actually checking is cheap next to that, by a wide margin.
So, check it
Go and look at that plugin list now, if you haven’t already. If everything’s current, that’s genuinely worth knowing. If it isn’t, or you can’t actually remember the last time you checked, that’s worth acting on today, not after the next alert.
