M
At this point, keeping a WordPress site secure is starting to feel less like website maintenance and more like playing Whac-A-Mole with a keyboard.
Patch one plugin, another vulnerability appears. Update that one, another security alert lands. Then a plugin you patched a few weeks ago suddenly needs another urgent update because researchers have found something else.
The latest example is Forminator, the popular WordPress forms plugin developed by WPMU DEV and installed on more than 600,000 websites.
Patchstack disclosed a high-priority vulnerability affecting Forminator versions up to and including 1.57.2, assigning it a CVSS score of 9.1. The flaw, tracked as CVE-2026-92229, involves unauthenticated arbitrary shortcode execution through the
That alone would be concerning enough.
The bigger problem is that this is simply the latest entry in what has become a remarkable run of security fixes for the plugin.
Patchstack currently lists 51 patched vulnerabilities in Forminator's history, including privilege escalation, arbitrary file upload, PHP object injection, stored cross-site scripting, information disclosure and multisite-related security issues.
The official WordPress plugin changelog paints a similar picture.
On August 18 alone, Forminator released a string of fixes covering privilege escalation, PHP object injection, multiple cross-site scripting vulnerabilities, Hub Connector security improvements, multisite registration problems and payment processing security issues.
Further security improvements followed on August 27, before another security-focused release, version 1.57.2.1, appeared on September 17. Version 1.57.3 was released the same day.
At some point you have to ask how website owners are supposed to keep up with this.
WordPress itself is not necessarily the problem here. The bigger issue is the enormous third-party ecosystem sitting around it.
A typical business website might have plugins handling forms, SEO, caching, backups, analytics, page building, security, payments, image optimisation and dozens of smaller functions.
Every one of those plugins introduces more code.
More code means more attack surface.
And every additional dependency means another developer whose security practices, release schedule and response times become part of your website's security posture.
Forminator is simply a very visible example because of its large install base.
Patchstack says the latest flaw requires no authentication and warns that vulnerabilities of this type may be attractive for mass exploitation because attackers can target large numbers of websites automatically rather than choosing victims individually.
That is the part ordinary website owners should pay attention to.
Attackers do not care whether your website gets 50 visits a month or 5 million.
If an automated scanner finds a vulnerable plugin, your website is simply another IP address and domain sitting in the queue.
The traditional advice to WordPress administrators has always been straightforward:
Keep WordPress updated. Keep your plugins updated. Keep your themes updated.
That advice remains correct, but in 2026 it increasingly feels incomplete.
You can update everything today and still receive a critical vulnerability warning tomorrow.
Forminator version 1.56.2, for example, included a fix for an arbitrary file upload vulnerability in July. August then brought another wave of security updates across the 1.57 branch, followed by another high-severity disclosure in September.
That does not automatically mean the developers are careless. In fact, actively identifying and patching vulnerabilities is far better than leaving them undiscovered or unresolved.
But from the perspective of the person actually running the website, the distinction offers little comfort.
They still have to patch it.
Again.
The days of installing WordPress, adding a security plugin and checking for updates once a month should probably be considered over.
A modern WordPress website needs multiple layers of protection.
Automatic vulnerability monitoring should be watching installed plugins and themes. Updates need to be applied quickly when a serious vulnerability is disclosed.
A web application firewall can provide another layer between the public internet and vulnerable application code. Unused plugins should be removed entirely rather than simply deactivated.
Backups also matter, but they are the recovery layer, not the security layer.
And plugin count matters more than many website owners realise.
If two plugins perform almost identical jobs, there is very little security benefit in keeping both installed. Every additional plugin is another collection of PHP, JavaScript, API endpoints and database interactions that somebody eventually has to secure.
Anyone running Forminator 1.57.2 or earlier should update to 1.57.3 or later.
Patchstack categorises the issue as broken access control, gives it a CVSS score of 9.1 and says the vulnerability can be exploited without authentication.
The official WordPress.org listing confirms that Forminator 1.57.3 was released on September 17, while version 1.57.2.1, released the same day, also contained unspecified security improvements.
There is no good reason to leave an affected version online.
WordPress remains popular partly because plugins make it possible to build almost anything without writing everything from scratch.
That strength is also one of its biggest security headaches.
Every plugin is another moving part.
Every moving part can break.
And judging by the rate at which vulnerabilities continue to appear, WordPress administrators increasingly need to treat vulnerability monitoring as a permanent operational job rather than something they think about after a security alert arrives.
Forminator will not be the last plugin patched this month.
It probably will not even be the last major one.
And that is what makes the whole situation feel increasingly absurd.
The WordPress security game currently looks a lot like Whac-A-Mole.
The only difference is that when you miss one, somebody may end up inside your website.
Patch one plugin, another vulnerability appears. Update that one, another security alert lands. Then a plugin you patched a few weeks ago suddenly needs another urgent update because researchers have found something else.
The latest example is Forminator, the popular WordPress forms plugin developed by WPMU DEV and installed on more than 600,000 websites.
Patchstack disclosed a high-priority vulnerability affecting Forminator versions up to and including 1.57.2, assigning it a CVSS score of 9.1. The flaw, tracked as CVE-2026-92229, involves unauthenticated arbitrary shortcode execution through the
current_url parameter. Version 1.57.3 is listed as the patched release.That alone would be concerning enough.
The bigger problem is that this is simply the latest entry in what has become a remarkable run of security fixes for the plugin.
Patchstack currently lists 51 patched vulnerabilities in Forminator's history, including privilege escalation, arbitrary file upload, PHP object injection, stored cross-site scripting, information disclosure and multisite-related security issues.
The official WordPress plugin changelog paints a similar picture.
On August 18 alone, Forminator released a string of fixes covering privilege escalation, PHP object injection, multiple cross-site scripting vulnerabilities, Hub Connector security improvements, multisite registration problems and payment processing security issues.
Further security improvements followed on August 27, before another security-focused release, version 1.57.2.1, appeared on September 17. Version 1.57.3 was released the same day.
At some point you have to ask how website owners are supposed to keep up with this.
Install plugin, update plugin, patch plugin, repeat
WordPress itself is not necessarily the problem here. The bigger issue is the enormous third-party ecosystem sitting around it.
A typical business website might have plugins handling forms, SEO, caching, backups, analytics, page building, security, payments, image optimisation and dozens of smaller functions.
Every one of those plugins introduces more code.
More code means more attack surface.
And every additional dependency means another developer whose security practices, release schedule and response times become part of your website's security posture.
Forminator is simply a very visible example because of its large install base.
Patchstack says the latest flaw requires no authentication and warns that vulnerabilities of this type may be attractive for mass exploitation because attackers can target large numbers of websites automatically rather than choosing victims individually.
That is the part ordinary website owners should pay attention to.
Attackers do not care whether your website gets 50 visits a month or 5 million.
If an automated scanner finds a vulnerable plugin, your website is simply another IP address and domain sitting in the queue.
The update treadmill is getting ridiculous
The traditional advice to WordPress administrators has always been straightforward:
Keep WordPress updated. Keep your plugins updated. Keep your themes updated.
That advice remains correct, but in 2026 it increasingly feels incomplete.
You can update everything today and still receive a critical vulnerability warning tomorrow.
Forminator version 1.56.2, for example, included a fix for an arbitrary file upload vulnerability in July. August then brought another wave of security updates across the 1.57 branch, followed by another high-severity disclosure in September.
That does not automatically mean the developers are careless. In fact, actively identifying and patching vulnerabilities is far better than leaving them undiscovered or unresolved.
But from the perspective of the person actually running the website, the distinction offers little comfort.
They still have to patch it.
Again.
WordPress security now needs several layers
The days of installing WordPress, adding a security plugin and checking for updates once a month should probably be considered over.
A modern WordPress website needs multiple layers of protection.
Automatic vulnerability monitoring should be watching installed plugins and themes. Updates need to be applied quickly when a serious vulnerability is disclosed.
A web application firewall can provide another layer between the public internet and vulnerable application code. Unused plugins should be removed entirely rather than simply deactivated.
Backups also matter, but they are the recovery layer, not the security layer.
And plugin count matters more than many website owners realise.
If two plugins perform almost identical jobs, there is very little security benefit in keeping both installed. Every additional plugin is another collection of PHP, JavaScript, API endpoints and database interactions that somebody eventually has to secure.
Forminator users should update now
Anyone running Forminator 1.57.2 or earlier should update to 1.57.3 or later.
Patchstack categorises the issue as broken access control, gives it a CVSS score of 9.1 and says the vulnerability can be exploited without authentication.
The official WordPress.org listing confirms that Forminator 1.57.3 was released on September 17, while version 1.57.2.1, released the same day, also contained unspecified security improvements.
There is no good reason to leave an affected version online.
The uncomfortable reality
WordPress remains popular partly because plugins make it possible to build almost anything without writing everything from scratch.
That strength is also one of its biggest security headaches.
Every plugin is another moving part.
Every moving part can break.
And judging by the rate at which vulnerabilities continue to appear, WordPress administrators increasingly need to treat vulnerability monitoring as a permanent operational job rather than something they think about after a security alert arrives.
Forminator will not be the last plugin patched this month.
It probably will not even be the last major one.
And that is what makes the whole situation feel increasingly absurd.
The WordPress security game currently looks a lot like Whac-A-Mole.
The only difference is that when you miss one, somebody may end up inside your website.