The plugin you forgot about is still running 🔓

Everyone checks their theme. Nobody checks the plugin they installed two years ago for one wholesale customer.

Last month there was a story about exactly that. A WooCommerce add-on called Wholesale Lead Capture had a critical hole (CVE-2026-27540, rated 9.8) that let strangers upload PHP files to the store. The fix, version 2.0.3.2, came out on 20 February. The attacks still peaked between June and August, and Wordfence says it blocked over 100,000 attempts. BleepingComputer has the whole thing if you run WooCommerce: https://www.bleepingcomputer.com/news/security/hackers-target-wordpress-sites-via-third-party-woocommerce-plugin/

So the patch was sitting there for months. People just didn't press update 🤷

If your shop runs on WordPress, give it 20 minutes this weekend:

• Open the plugins page and delete everything you don't use. Not deactivate. Delete ❌

• Update the rest and switch on auto updates where you can

• Look up your PHP version in the hosting panel. If it still says 7.something, call your host on Monday

• Make a backup before you touch anything

Every plugin is one more door. Lock the ones you need and brick up the rest.