Security flaw reported in a WordPress plugin or theme: the steps to take
PrintYou have been told that one of the extensions on your site has a published security hole. This happens often, and the fix usually takes only a few minutes. What matters is acting quickly: the affected versions are listed publicly, and automated scanners start looking for vulnerable sites soon after the announcement.
In short: move the component to the release that closes the hole. If the author has not shipped a fix, remove it and choose a replacement. Then use Imunify360 and your WordPress user list to confirm nobody got in before you patched.
What a "known vulnerability" means
A security problem was found in a specific version of the plugin or theme and made public, normally together with the release that solves it (shown as "fixed in" in reports). It does not mean your site has been hacked. It means the site stays exposed until you update.
The warning may come from WP Toolkit (listed in cPanel as "WordPress Management"), from the WordPress updates screen, from a security plugin, or from the TopHost support team.
The steps, most important first
- Take a fresh copy of the site. Automatic JetBackup backups already exist, but a copy made right before the change lets you roll back at once. For a safe routine, see Updating WordPress without breaking the site.
- Update the affected extension. We recommend cPanel for this: open WP Toolkit, pick the site and use the Update button next to Plugins or Themes. On plans with Softaculous, WordPress Manager by Softaculous works too. The alternative is the WordPress dashboard: Dashboard, then Updates. Afterwards, confirm the installed version is the fixed one or newer.
- No fixed release available? That usually means the author has abandoned it. Deactivate and delete it. When looking for a replacement on wordpress.org, check the last update date, the number of active installs and compatibility with your WordPress version.
- Do not keep deactivated extensions around. A plugin switched off in the dashboard still has its files in
wp-content/plugins, and some flaws can be attacked through those files directly. The same goes for old themes: keep the active one and, at most, one default theme as a fallback. - Locked out of wp-admin? Open File Manager in cPanel, go to
public_html/wp-content/plugins(or the site's folder if WordPress runs on an addon domain) and rename the plugin's folder, for example by adding-offat the end. WordPress will treat it as deactivated. Full walkthrough: Reading error_log and disabling the plugin that causes an error. - Check whether the hole was already used. In cPanel, under Security, open Imunify360 and read the scan results. In WordPress, go to Users, filter by the Administrator role and look for accounts you did not create. If infected files show up, continue with An Imunify notice about infected files.
Common mistakes
- Paid themes or plugins downloaded for free from unofficial sites. They often carry hidden code and never get updates.
- Updating only WordPress itself. Most flaws live in plugins and themes, not in the core.
- Leaving it "for the weekend". Automated attacks do not wait.
Keeping it from happening again
- Turn on automatic updates: in WP Toolkit (Smart Update included, see the WP Toolkit guide) or in WordPress under Plugins, with the Enable auto-updates link next to each plugin.
- Keep installed only the extensions you actually use.
- Protect administrator accounts with two-factor login and use the Imunify Security plugin if it is available for your site: Imunify Security inside WordPress.
If the site stops working after the update, or you are unsure what to replace the plugin with, open a ticket and name the plugin or theme. You can also return to the previous state yourself with JetBackup: How to restore a website or specific files using JetBackup 5.
