09/23/2026
:: When "Just Update WordPress" Isn't Enough
Every so often WordPress pushes a security release that's more than routine, and this is one of those weeks.
WordPress 7.1.2 came out on September 22 to fix a critical bug that can lead to remote code ex*****on. It affects every version all the way back to 4.7, and in some instances an attacker doesn't need to log in to try it.
If you're thinking "didn't we just update for 7.1.1 last week?" you're not imagining it.
That was only five days earlier. The Core team is moving fast right now, and that alone tells us something [hint].
For TVCNet and HackGuard customers, the priority is simple: confirm you're actually on 7.1.2 or the matching backport. Don't assume auto-updates just quietly happened in the background. It very likely hasn't...
If a site does get compromised through a bug like this, cleanup isn't just replacing infected files. It's a credential incident too.
Passwords, wp-config, admin accounts and hosting panel logins all get treated as potentially exposed.
One more thing this week, and this one is the bigger picture:
- Security researchers just documented a malware family that hides inside Must-Use plugins, so it never shows up on your normal Plugins screen.
- It uses the Ethereum blockchain to find its command servers, which makes it hard to shut down.
- It can quietly steal admin details, payment settings and customer order data, it's designed to rebuild itself after removal, and it may try to spread to other sites under the same account.
That kind of persistence is exactly why, if your site is hacked, we look beyond the dashboard, and why one compromised site sometimes means the whole account needs a closer look as well.
In short: patch fast, verify, and if something looks off, ask. We are here to help.
If you're on HackGuard, we're watching and we'll reach out if action is needed. If you're not, and this lands a little too close to home, that's what we're here for.
