Nobody wants to hack your website. They want to use it
The most common objection we hear about website security is entirely reasonable: why would anyone bother hacking us? The site is a brochure. There is no customer data on it, no payments, nothing worth stealing. The objection assumes the attacker wants what is on your website. They do not. They want the website itself: a clean, trusted, always-on server, in a respectable neighbourhood of the internet, that nobody is watching. Two pieces of research this week show both halves of that trade: the door, and what your site gets used for once someone is through it.
The door: a contact form that accepts code
Researchers at Patchstack disclosed a critical flaw in Elementor Pro, the paid version of one of WordPress's most widely used page builders. The bug, CVE-2026-32475, rated 9.0 out of 10, sits in the Forms module's file-upload field. By submitting a form in a particular way, an attacker with no login can slip a PHP file, code the server will run, past the safety checks and into a public folder. From there they can run commands on the server: full takeover, through the same contact form your visitors use.
The conditions are ordinary. The site needs one published page with a form that has a file-upload field: a job application form, an "attach a photo" support form, a quote request with documents. Versions up to and including 4.2.1 are affected; version 4.2.2, released on 19 August, fixes it.
One flaw in one plugin would be a footnote. It is the pattern that matters. In the past few weeks alone, Forminator (600,000 sites) shipped a 9.8-rated hole that also let strangers upload runnable code through forms, and User Profile Builder (40,000 sites) fixed a bug that could hand an attacker the administrator account. Earlier this summer it was W3 Total Cache, on 900,000. Different plugins, different bugs, same shape: the extra features bolted onto WordPress are the way in, and forms that accept uploads are a favourite, because an upload field is halfway to being an "install software here" field before anyone makes a mistake.
What your site becomes afterwards
The second piece of research answers the "why us" question directly. Check Point mapped a crime operation it calls StopAndProtect that runs on close to 2,000 hacked WordPress sites. Not the criminals' own servers: other people's ordinary websites, quietly repurposed.
The hacked sites do the operation's day-to-day work. They store the malware. They act as the command channel that infected computers report to. They hold the stolen documents, screenshots, and activity logs the gang collects from victims. And they serve fake "prove you are human" pop-ups to their own visitors, tricking them into running a command that infects their computers. The owners of those 2,000 sites are not victims of data theft. They are unwilling landlords, and every one of their visitors is a potential next victim, attacked by a domain they had every reason to trust.
Check Point's look inside the operation found what you would expect: most of the hijacked sites were running outdated WordPress versions and outdated plugins. One was on a version from 2021, carrying roughly 40 known holes. Nobody picked these sites because they were interesting. They were picked because they were unlocked.
This is the part the "nothing worth stealing" objection misses. A hacked website costs you in three currencies: your visitors get attacked under your name, your domain gets blacklisted by browsers and email providers (taking your email deliverability with it), and the clean-up lands at the worst time, because you find out when a customer, or Google, tells you.
The habit, not the patch
If you run Elementor Pro, update to 4.2.2 now. But the specific patch is the least of it. The pattern repeats monthly, so the defence has to be a standing habit rather than a news alert:
Know what your site runs. A one-line inventory: WordPress version, theme, every plugin, and who is responsible for updating them. If your site is looked after by an agency or freelancer, ask them for exactly this list and when things were last updated. If they cannot produce it quickly, that is your answer.
Turn on automatic updates and shrink the plugin list. Auto-update WordPress itself and every plugin that allows it. Then remove, not deactivate, remove, every plugin the site does not need. Each one is a door someone else built into your building. Fewer doors, fewer 2am surprises. Our earlier filing on a plugin that was compromised without changing covers why even updated plugins deserve a short leash.
Treat upload forms as the sharp edge. Know which of your forms accept file uploads, and whether you still need them to. Every one of this month's worst WordPress bugs went through an upload field.
Decide who would notice. If your site started serving malware tomorrow, who would see it first, you or your visitors? A monthly five-minute check of the site from the outside, or a monitoring arrangement with whoever maintains it, changes that answer.
How Steelwise can help
Getting a plain answer on what your website runs, what state it is in, and whether the person maintaining it is actually maintaining it is the kind of review we do. Get in touch.