WordPress Plugin Security Advisory: October 2026

On October 1, 2026, four WordPress plugins disclosed critical authentication bypass vulnerabilities on the same day. Each one is rated CVSS 9.8, and each one allows an unauthenticated visitor to take over an administrator account on an affected website.

Exploitation is already underway. A public proof of concept with mass-scanning capability is circulating for one of the plugins, and Wordfence blocked 137 attacks against another within a 24-hour period.

The affected plugins and the fixed versions

If your website runs WordPress, check whether any of these plugins are installed:

• DevKit Pro, versions 2.3.0 and below (CVE-2026-14378). Fixed in version 2.3.1; the developer recommends updating to 3.0.0 or later.
• Divi Membership, versions 2.3.0 and below (CVE-2026-19660). Fixed in version 3.0.0.
• JSON API Auth, versions 3.1.2 and below (CVE-2026-97637). Fixed in version 3.1.3.
• WPMobile.App, versions 11.82 and below (CVE-2026-94541). Fixed in version 11.85.

You can check your installed plugin versions in the WordPress admin area under Plugins. The Plugins page shows the version number for each installed plugin.

What to do now

If your website uses any of these plugins, take these steps:

1. Update immediately. Install the fixed version of each affected plugin through the WordPress admin area. If you cannot update right away, deactivate the plugin until you can.
2. Check for signs of compromise. Because these flaws were publicly known before patches were available, review your site for new or unexpected administrator accounts, unfamiliar files, and changes you did not make. Pay particular attention to the administrator list under Users.
3. Restore and reset if anything looks wrong. If you find evidence of unauthorized access, restore from a clean backup made before the exposure period, then reset all administrator passwords.
4. Keep plugins updated going forward. WordPress core, themes, and plugins should be kept current, and plugins you no longer use should be removed rather than left installed and inactive.

Why this matters beyond these four plugins

An SSL certificate and a strong password protect different parts of a website. This incident is a reminder that the plugin layer is its own attack surface: a flaw in a single plugin can bypass authentication entirely, regardless of how strong the administrator passwords are.

Website security works in layers. Connection encryption, access controls, software updates, monitoring, and backups each cover a different risk. When one layer fails, the others determine how much damage follows.

If your website is hosted with InterProWebHost and you are unsure whether you are affected, contact the InterProWebHost team and include your domain name.

Frequently asked questions

How do I check which plugins my WordPress site has installed?

Sign in to your WordPress admin area and open the Plugins page. Every installed plugin is listed there with its version number, so you can compare against the affected versions: DevKit Pro 2.3.0 or below, Divi Membership 2.3.0 or below, JSON API Auth 3.1.2 or below, and WPMobile.App 11.82 or below.

What should I do if I was running a vulnerable version before the patch?

Update to the fixed version first, then check for signs of compromise: new or unexpected administrator accounts, unfamiliar files, and changes you did not make. If you find anything suspicious, restore from a clean backup made before the exposure period and reset all administrator passwords.

Can a strong admin password protect against these flaws?

No. These are authentication bypass vulnerabilities, which means they let an attacker skip the login process entirely. Password strength does not help against this class of flaw; only the patched plugin version closes the hole.