Fluent Forms Pro shipped a backdoored update for five hours: CVE-2026-73532

On August 14, the paid edition of Fluent Forms, the WordPress plugin used to build contact forms and surveys, was assigned a CVE number for shipping a fake update with an attacker's backdoor inside it (CVE-2026-73532, severity 9.8). The paid edition of Ninja Tables, a table builder from the same developer, is covered by a second entry (CVE-2026-73533, 9.8).

The free edition of Fluent Forms alone runs on 700,000 sites. Only the paid edition (Pro) is affected here; the free edition is not.

The cause was a server the developer forgot to switch off. After moving its store and licensing onto a new platform, the old server was left running, and proxy rules kept sending some update traffic to it. Someone got into that server and swapped the files it handed back. The tampered builds went out for roughly five hours, from 14:00 to 19:00 UTC on July 31. By the developer's own count, about 295 accounts actually received them.

What was planted was a passwordless administrator entrance and persistence that survives deleting the plugin. Patchstack's entry classifies the case as a backdoor and treats it as already exploited.

This article tracks cases where the WordPress plugin delivery channel itself was hijacked. The three that were assigned CVE numbers on August 7 — the analytics staple MonsterInsights Pro (CVE-2026-11976, severity 10.0), three paid plugins from Supsystic (CVE-2026-17032, 9.8), and Premium SEO (CVE-2026-14812, 10.0), which was built for takeover from the very start — are covered in the sections below.

What the five have in common is not the nature of the flaw. The problem is not how the code was written but how it was delivered: you get broken into as a result of clicking the update button, an entirely correct thing to do. The Fluent Forms case is the fourth of its kind in a year.

Who is affected, and what to do

Here are all five cases, seven products, newest first, so you can check whether your site is affected. In every case, only the paid editions are affected. The free editions hosted in the official WordPress directory (WordPress.org) are not covered by any of these. Severity figures come from VulnCheck for the top two and from WPScan for the rest.

As you can see, all seven require no login. The attacker needs neither a username nor a password, because the plugin arrives with the attacker's entryway already built into it.

For Fluent Forms and Ninja Tables, the tainted builds were only being served for five hours. If you did not download the paid edition on July 30 or 31, you are almost certainly not affected. The developer emailed all 1,368 customers who could have been caught, and says that not receiving one means you are not affected.

Who is behind this, what they do, and what you stand to lose

The people who choose this method are attackers who have given up on hitting sites one at a time and instead hit the distributor once. Rather than combing individual sites for holes, it pays far better to seize a channel that reaches every site running the plugin in a single stroke. In the Fluent Forms case, the target was not a website at all but one old server the developer had forgotten to switch off. In the MonsterInsights case it was a single storage bucket of update files kept on Amazon's cloud. Either way, exactly one place was breached.

And then what? They embed machinery in the distributed package that quietly creates administrator accounts. An administrator account that never appears in the interface gets set up, and its username and password are sent outside. The mechanics differ from case to case. The file mixed into MonsterInsights built an entryway that lets someone through authentication simply by appending a particular string to a URL. The code distributed in June through OptinMonster and its siblings was written to wait quietly for the site's administrator to log in and, the moment the dashboard opened, borrow those privileges to create the account. The shape of the entrance differs; where it leads does not.

There is a shared habit in how things get named, too. In the June cases, the destination for stolen data was tidio.cc — an unrelated domain deliberately kept one character away from tidio.com, the widely used chat tool. In the July Fluent Forms case it was apii.observer, the scheduled task planted for persistence was called wp_update_check_schedule, and the database rows were named things like _site_transient_update_meta. Every one of them looks like something WordPress ships with. They are built so that an administrator skimming a list slides right past them.

What you lose is the site itself. Once someone holds an administrator account, they can rewrite your posts, swap out your payment destination, or serve different malware to your visitors. If you sell online, order records and shipping addresses are sitting there ready to be carried off; if you run a membership site, so is your member list. The heaviest part of this case is that the break-in was not the result of visiting a shady site, but the result of clicking the update button in the dashboard — an entirely correct thing to do. The same pattern played out when axios, a staple JavaScript component, was hijacked, and when four open-source projects fell in a 10-day chain reaction that started with the scanner Trivy.

Fluent Forms was served from a server nobody remembered

The developer is WPManageNinja, a company based in Dhaka, Bangladesh, with 17 plugins in the official WordPress directory. Free-edition installs: Fluent Forms on 700,000 sites, FluentSMTP on 600,000, FluentCRM on 80,000, and Ninja Tables on 70,000. The company says its products power more than 1.5 million sites worldwide.

It started with a migration. WPManageNinja moved its store and licensing off Easy Digital Downloads onto its own platform. The move finished, but the old server was never switched off, and internal proxy rules kept routing some update requests to it. A server nobody was watching stayed alive as a legitimate counter.

On July 31, someone got into it and swapped the files it handed back. The proxy passed them straight through to customers. Founder Shahjahan Jewel told the industry outlet The Repository:

← swipe to move

CVE-2026-73532: one added line grows into a backdoor that will not leave

Severity 9.8, written out as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H: reachable over the network, no privileges and no user interaction required. Under the newer scheme (CVSS 4.0) it is 9.3. The classification is CWE-506, embedded malicious code — a category that says this was put there on purpose, not written by mistake. It was published to NVD at 16:19 UTC on August 13, sourced from the U.S. vulnerability-intelligence firm VulnCheck.

The difference from the clean build is startlingly small. The plugin's main file, fluentformpro.php, has exactly one extra include line. What it pulls in is libs/class-license-sync.php — a name plausible enough to belong there, carrying a fake plugin header that reads "WP License Sync". Skimming the file listing will not catch it.

Everything else follows from that one line. The loaded code builds four things into the site.

First, a passwordless administrator entrance. A file beginning with db-repair- is dropped into wp-content/mu-plugins/, the directory WordPress always loads and which never appears in the plugin list. It logs whoever opens a specific URL straight in as the lowest-numbered administrator on the site — and that URL is dressed up to look like the ordinary admin-email confirmation link (confirm_admin_email) WordPress sends out.

Second, a channel for talking to the outside: an endpoint at /?rest_route=/wp-update/v1/check that reports to https://apii.observer/ingest. Third, persistence as configuration: rows written to the database under names like _site_transient_update_meta and _wp_update_result_cache, near-copies of names WordPress uses itself. Fourth, scheduled tasks: wp_update_check_schedule and wp_license_verify_schedule, which keep running after the plugin is deleted.

On top of that, according to reporting, the rogue administrator account gets added to the allowlist of whatever security plugin the site already runs, so the "a new administrator was created" alert never fires. The build assumes you are monitoring, and silences the monitor first.

CVE-2026-73533: Ninja Tables got the same payload

Severity 9.8, same CWE-506 classification. The affected build is Ninja Tables Pro 5.2.11, and the planted file is app/Library/updater/NinjaTableDataSync.php. Different name, but NVD's description lists exactly the same behavior as the Fluent Forms case: the backdoor endpoint, the files left behind, the passwordless administrator, the scheduled tasks. Same channel, same payload. Safe from 5.2.13 onward, with the official cleanup guide written against 5.2.14 and later.

This time, the developer said all of it

Here is where this case parts ways with the others in this article. WPManageNinja published the whole thing the next day: the exact window the tampered builds were served, that the cause was its own forgotten server, how many accounts received them, which files and callback domain and scheduled tasks to look for, and how to remove them. All of that is in the notice.

MonsterInsights and Supsystic, covered below, have published nothing about their breaches. With the same class of incident, whether users can check their own situation comes down to how much the developer is willing to say. The file names and domains in this article exist because one developer chose to publish them.

The notice carries an honest caveat, too: a clean result from a commercial security scan is not proof that you were not hit. That tracks, because the persistence lives in database rows and scheduled tasks rather than files, which a file-oriented scan walks straight past. As remediation, the company removed the old server and the proxy rules, rotated every credential, and says it is moving all its plugins to checksum-based updating. That is precisely what was missing across every case here.

With MonsterInsights, even the rollback target was tainted

CVE-2026-11976: the update file store itself was taken over

Severity 10.0. On CVSS, a scale that tops out at 10, there is nothing higher. Written in shorthand, it is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: exploitable over the network, with no tricky preconditions, no privileges and no action from the user, and with damage that spreads beyond the site itself (S:C).

What was taken over was monster-insights.s3.amazonaws.com, the location on Amazon's cloud storage where MonsterInsights Pro's update files lived. The attacker obtained write access there and added class-system-check.php to the distributed package. By name alone it reads like a "system check" component, and it does not look out of place inside a plugin.

The trouble is what came next. The developer found the problem in 10.2.2, which was being distributed at the time, and rolled back to the previous 10.2.0. As incident response goes, that is the textbook call. But 10.2.0 already contained the same malicious file. The attacker had poisoned the version that would become the rollback target in advance.

WPScan's analysis rates the build that shipped in 10.2.0 as the most dangerous. It carried three capabilities: hijacking the update mechanism itself, planting an administrator account that will not go away, and bypassing authentication with nothing more than a particular string appended to the URL. As long as the first of those is active, you can update to what you believe is a clean version and still receive whatever the attacker has prepared.

Over the course of June 11, three variants were observed. All three used the same encryption key (AES-256-GCM), which is the basis for concluding that a single actor — one person or one group, not several — spent the day reworking the payload. The NVD entry states explicitly that the attacker still held write access to the storage location at the time of the report.

The leaked AWS access key is AKIA2QECJAQPPMAUL6XT. The safe version is 11.0.0 or later; the current free edition is 11.1.2 (updated July 29). The report came from Mike Gozdiskowski, the same researcher behind the Supsystic report discussed below.

This connects to the OptinMonster incident back in June

Worth pausing here on where MonsterInsights sits. The company's own about page names Syed Balkhi as its founder and lists "sister brands" including OptinMonster, WPForms, All in One SEO, SeedProd and Duplicator. Its careers page points to Awesome Motive. Think of it as a single family of brands, and one of the largest in the WordPress world.

The numbers look like this. Counting free-edition installs alone: WPForms 5 million sites, All in One SEO 3 million, MonsterInsights 2 million, OptinMonster 1 million. Those four together come to 11 million sites. That is the reach when one distribution channel is broken open.

This family of brands was already in the news over this in June 2026. According to research by the Dutch security firm Sansec and reporting from BleepingComputer, files served from the delivery network (CDN) were swapped out for three products: OptinMonster, TrustPulse and PushEngage. A CDN is a relay network that delivers images and programs quickly to users around the world. The attacker got into the server running Awesome Motive's marketing site through a known hole in a different plugin, UpdraftPlus, and made off with the CDN keys stored there. The way in was not the plugin itself but the promotional website.

The hole used as that entrance may well be on your own site too. UpdraftPlus is a backup plugin, and about 3 million sites run it. The flaw is CVE-2026-10795 (severity 8.1), affecting 1.26.4 and earlier, fixed in 1.26.5; the current release is 1.26.6. It lets an attacker slip past authentication without logging in, it was published on June 10, and two days later it was used in this very attack. As of August 6 it does not appear in the U.S. CISA catalog of vulnerabilities known to be exploited, but a documented record of real-world use arguably weighs more than presence on the list. Even if none of the cases here applies to you, this one is worth checking.

The code planted back then also waited for an administrator to log in, created a hidden administrator, and sent the credentials to tidio.cc. The backdoor it installed was built so that it appeared neither in the plugin list nor in update checks, and Sansec identified two aliases it used: "Content Delivery Helper" and "Database Optimizer."

What stands out is how briefly it was live. By Sansec's account, the malicious code was served for OptinMonster and TrustPulse for 25 minutes, from 22:17 to 22:42 UTC on a Friday. Only PushEngage ran longer, until 19:02 UTC the following day. Twenty-five minutes of a swapped externally loaded file is enough to reach something on the order of a million sites. You can be caught up in it without having touched a single line of your own site's code — that is the essence of this technique.

In the MonsterInsights Pro case that has now received a CVE, the exfiltration domain matches and the timing overlaps almost exactly, June 11 to 12. Treating it as part of the same campaign is the natural read. There is a difference, though. What was reported in June was the swapping of JavaScript served from a CDN; what has now been assigned a CVE is PHP files in the plugin itself being mixed into the legitimate update distribution. This one reaches deeper.

The developer has never disclosed that the S3 bucket was taken over

The fixed version, 11.0.0, went out on June 17. Yet what the official changelog records under 11.0.0 is a single line: various bug fixes and updates. Nothing about malware in the distributed package, nothing about the cause. Neither the blog nor the announcements carry any report of the incident.

What the official account did post on June 12 was about something else.

What that notice refers to is fake update emails riding on the confusion. Messages went around claiming to be "MonsterInsights 10.3.0 Critical Security Update," but there is no version 10.3.0 (10.2.2 was followed by 11.0.0). The vulnerability number quoted in them did not exist either, and the link led to a lookalike site whose domain name had one extra "i" in it.

The reaction from people on the receiving end is on the record too.

The official site wasn't responding, and the only thing arriving was a plausible-looking update email — that was the view from the user's side. A warning about phishing did go out, but an explanation that the distributed package itself had been tainted never came, not then and not after 11.0.0 shipped.

Supsystic's paid plugins were made to fetch fake updates on their own

CVE-2026-17032: one passphrase and commands go through

Severity 9.8. The affected products are three paid plugins sold by a developer called Supsystic: Easy Google Maps Pro (1.6.9) for maps, Photo Gallery by Supsystic Pro (2.10.9) for photos, and Data Tables Generator Pro (1.9.20) for tables. Here too the way in was the developer's update server, which was hijacked and then handed out builds with malicious code baked in.

Drawing on WPScan's record, the planted capabilities break down as follows.

First, command execution via a passphrase. Attach one fixed line, X-Forwarded-Validation: supsystic-cdn-82a7, to a web request and any command you like runs on the server. No login required. Second, authentication bypass: present the right passphrase and you are in as an administrator with no password. Third, automatic creation of administrator accounts, where the username and password are derived mechanically from the site's own settings, so an attacker can work them out ahead of time. On top of that, the site's URL, the server's IP address and assorted version numbers were being sent back to the attacker.

The nastiest piece is the one built for staying put. The plugin's automatic update destination was pointed at a distribution server the attacker controlled. You clean the site up, and the next automatic update brings the same thing right back. That is the same goal as the "hijack the update mechanism" function found in MonsterInsights 10.2.0.

The fixed versions are 1.7.0 / 2.11.1 / 1.10.1. This case was registered with WPScan on July 24, and the CVE number was assigned on August 7. The free editions (Easy Google Maps 20,000 sites, Photo Gallery 20,000 sites, Data Tables Generator 10,000 sites) are not affected.

Here too, there was no disclosure. Neither Supsystic's own site nor the official WordPress support forums carry any explanation of the incident. All that remains is a single line in the changelogs of the three free plugins. Between July 30 and 31, Easy Google Maps 1.13.0, Photo Gallery 1.17.1 and Data Tables Generator 1.13.1 were updated one after another, each carrying the same wording.

"Unofficial version detected" reads as though code was added to recognize the tainted builds. But nothing says what happened, who is affected, or how to check. A user is not going to get from that one line to this incident.

"Premium SEO" was built to take over sites from day one

CVE-2026-14812: there is no fixed version

Severity 10.0. This one is a different animal from the other two, though. It is not that a vulnerability was found in the plugin; the plugin itself was built to take over sites. The WPScan record by Erwan LR classifies the product bluntly as a "malicious plugin."

"Premium SEO" (credited to Web SEO Services) does not exist in the official WordPress directory. Where it was being distributed from is not known — WPScan's record doesn't say either. The one established fact is that it arrived without passing through the official directory. The affected builds are 6.x / 30 / 36 / 37 / 38. Every version can create hidden administrators and inject content, and from the 6.x line onward it adds command execution on the server, probing of the internal network, and dumping of server information.

A word of caution about the name. There is a completely separate, legitimate plugin called "Premium SEO Pack". WPScan goes out of its way to note this. The names merely resemble each other; that one has nothing to do with this incident. To avoid deleting the wrong thing, check whether the folder name is Premium-SEO.

The indicators are clear. The file is wp-content/plugins/Premium-SEO/seo-automation.php. The administrator it creates has a username beginning with resource_desk_ and the email address wppremiumseoplugin@gmail.com. It communicates with public.imagehosting.space and public1.imagehosting.space. In the database it writes settings such as head_scripts_seo, copyright_footer_links and seo_automation_owner_id.

There is no fixed version, because there is no one to fix it. The response is deletion, removal of any administrator accounts it planted, and a check for spam landing pages it created on its own plus scripts injected into the header and footer. All three cases share this: updating is not where the job ends.

Why paid editions keep being the target

First, a sense of how wide this reaches. In W3Techs' survey, among websites written in Japanese whose underlying system can be identified, 82.8% run WordPress (as of August 6, 2026). Second place is Shopify at 2.9% — a gap of nearly 30 times. Building a Japanese-language website is, in practice, close to synonymous with using WordPress.

It is no accident that all five cases involved paid editions. WordPress plugins receive updates by two different routes.

One is through the official directory (WordPress.org). Free editions live there and their updates come from there. The code is exposed to community eyes, and WordPress runs the distribution servers. The other is through an update server the developer runs themselves. Paid editions cannot be hosted in the official directory, so each company stores its own files, checks its own licenses and does its own distribution.

The second route means thousands of separate distribution setups, each standing on its own, each maintained to whatever standard that company happens to keep. How well they are defended varies from vendor to vendor. What was actually breached was one old server nobody had switched off, one storage bucket on Amazon's cloud, one update server, and one set of keys left lying around on a marketing site. However carefully the plugin's own code is written, none of it matters if the pipe that delivers it is broken open.

From the user's side, the difference is almost invisible. The dashboard shows the same "Update" button, and free and paid plugins are updated from the same screen with the same click. Nothing on that screen tells you whether the click reaches the official directory or the developer's own server. That indistinguishability is what makes this case unsettling.

WordPress core does not check whether the update file it received is genuine

This is the fact sitting at the bottom of the whole story. WordPress does not cryptographically verify that a downloaded plugin file is authentic. That holds whether the file came from the official directory or from a developer's own server — no distinction is made.

The machinery was built once. WordPress 5.2 (May 2019) introduced the ability to attach a cryptographic signature to a release and verify it. A cryptographic signature is a way of proving mathematically that a file has not been altered since it left the publisher's hands. Even then, though, Paragon Initiative, which worked on the feature, wrote that "themes and plugins are still unsigned".

And since then? The current WordPress source code spells out the list of keys used for verification like this.

The number 1617235200 points to April 1, 2021. The moment that date passed, the list of trusted keys became empty. And that last line — the note to add key #2 with a longer expiration — is a piece of unfinished business still sitting there five years later.

In June 2024, WordPress switched the verification off altogether. The record of that change gives the reason: disable it "at least until signing is fully implemented on WordPress.org." And in fact, the function that downloads a release today has the "verify the signature?" argument hard-wired to false.

What can be checked is limited. The official directory publishes a per-plugin file list with checksums — values computed from a file's contents, like a fingerprint. But the only thing that goes and reads them is WP-CLI, the command-line version; WordPress core's own update routine never consults them. And for self-distributed paid editions, no such list exists in the first place. The only thing actually verified is that the connection is encrypted (HTTPS). If the party on the other end of that connection has been taken over, encryption protects nothing. Which is exactly what happened with MonsterInsights.

A plugin can rewrite where its own updates are fetched from

There is a second reason the "hijack the update mechanism" capability seen in two of these cases works at all.

For a paid edition to deliver updates from its own server, it has to tell WordPress "the new version of this plugin is over here." The hook for doing so exists as an officially documented extension point. A plugin inserts its own row into the list of available updates and is free to write whatever download URL it likes. This is not a bug; it is the legitimate design that makes the paid-plugin business possible.

Turn that around and code that has once made it onto a site gets to decide where its future updates come from. Supsystic's "automatic update destination pointed at the attacker" and MonsterInsights 10.2.0's "hijack the update mechanism" capability both ride on this design. That is the reason a site you thought you cleaned gets reinfected at the next automatic update. Deleting a plugin and reinstalling it, rather than just updating, is worth doing precisely because it cuts that path.

The same thing has happened four times in a year

Is this a freak accident? No. Hijacked distribution channels for paid plugins have been happening back to back.

In June 2026, backdoors were planted in three paid plugins from a developer called ShapedPlugin. The tainted builds were Smart Post Show Pro 4.0.1, Product Slider for WooCommerce Pro 3.5.2 and Real Testimonials Pro 3.2.4, fixed in 4.0.2, 3.5.3 and 3.2.5 respectively. That is CVE-2026-10735, severity 9.8. Distribution ran through the company's license management server, and the free editions in the official directory were untouched. According to reporting on the case, what was carried off included database credentials, administrator accounts, mail-sending credentials, and online store order data.

There is one more line in that record. WPScan notes that "after reporting, the developer became unreachable." Distributing your own product means also carrying, yourself, the duty to speak up when something goes wrong. When that duty goes unmet, users have no way of finding out.

Go back further and you reach July 2025, when malware was found in versions 2.9.11.1 and 2.9.12 of Gravity Forms as served from the vendor's own site. In that case, though, the developer stated plainly that anyone who installed via automatic updates was unaffected; only manual downloads and Composer installs were tainted. We have covered Gravity Forms vulnerabilities here more than once.

Laid out in order: Gravity Forms in July 2025, ShapedPlugin in June 2026, MonsterInsights and its sibling brands that same June, and Fluent Forms and Ninja Tables on July 31. Two form builders, two display components, one analytics plugin. What is being targeted is not one company or one category but the WordPress arrangement itself, in which every vendor distributes its own paid edition. When "we moved house and forgot to shut the old place down" is enough to make it work, there is no reason to expect this to be the last one.

One more thing: a plugin installed from outside the official directory shows no update notice in the dashboard even after a danger comes to light. The same reason kept updates from reaching users in three of the 24 flaws disclosed on August 5. You can also check whether the libraries and plugins you use have known problems with a free tool that matches them just by pasting in your dependencies.

Checking whether your own site is infected

In none of these cases is updating the end of it. If someone already got in, they left things behind. Start with Fluent Forms and Ninja Tables, where the indicators are published in the most detail.

If you run Fluent Forms or Ninja Tables

First, the baseline: if you did not download the paid edition on July 30 or 31, you are almost certainly not affected. The developer emailed everyone who could have been caught and says that no email means no exposure. If you want to check anyway, this is the order.

1. Check the version. If Fluent Forms Pro is still on 6.2.7 or Ninja Tables Pro on 5.2.11, start by replacing them.

2. Look for the files. The presence of fluentformpro/libs/class-license-sync.php or ninja-tables-pro/app/Library/updater/NinjaTableDataSync.php means you have a tampered build. Also check wp-content/mu-plugins/ for any file beginning with db-repair-, and wp-content/uploads/ for anything ending in .php. A program file sitting in the folder meant for images and documents is itself the anomaly. Per the developer, the dropped files carry eight-character hex-looking names and run roughly 200 to 550 bytes.

3. Query the database — this is the one that matters. The developer calls this the only reliable check:

A single row returned means the malicious code ran on your site. Installing the clean build does not remove that row. Swapping the files and assuming you are done is the trap in this case. The names written in — _wp_update_meta_cache, _site_transient_update_meta, _wp_update_result_cache, _site_transient_update_result, _wp_update_pending_reg — are all a character or two away from names WordPress uses itself.

4. Check the scheduled tasks and the endpoint. Look for wp_update_check_schedule and wp_license_verify_schedule. Then open https://yoursite/?rest_route=/wp-update/v1/check in a browser. If something comes back, the backdoor endpoint is live.

5. Remove things in the right order. The developer's sequence: put the site in maintenance mode, delete the affected plugin directories rather than updating them (your forms and tables live in the database and survive), remove the rogue files from mu-plugins and uploads, delete the database rows, delete the scheduled tasks, then re-run every check. After that, run the same checks again 24 hours later to see whether the persistence rebuilt itself. Finally, rotate administrator passwords and the WordPress salts.

The developer recommends scanning with a commercial security plugin as well, while stating plainly that a clean scan is not proof you were not compromised — and that if you cannot verify the cleanup, restoring from a backup taken before July 31 is the surest route. Our free tool that checks dependencies against known problems can help alongside this, though it looks for known vulnerabilities rather than an implanted backdoor.

If you run MonsterInsights, Supsystic or Premium SEO

1. Open the user list. Go to "Users" in the dashboard and check whether any administrator is there that you don't recognize. Start with the ones whose names are known. For Premium SEO, look for a username starting with resource_desk_ or the email address wppremiumseoplugin@gmail.com. For the June Awesome Motive incident, Patchstack's analysis reports two kinds: a fixed username developer_api1 (with the email customer1usx@gmail.com), and usernames made of dev_ followed by random characters. Even if nothing matches those, treat any unfamiliar administrator created on or after June 11 as suspect.

2. Look for the files. On the server, check whether class-system-check.php (MonsterInsights Pro) or Premium-SEO/seo-automation.php (Premium SEO) is present.

3. Check outbound destinations. Search your server's traffic logs for tidio.cc and imagehosting.space. tidio.cc has nothing to do with tidio.com. It is easy to miss on sites that genuinely use the Tidio chat tool, so read all the way to the end of the name.

4. Suspect an invisible backdoor. The backdoor installed in the June incident was built not to appear in the plugin list. The names were "Content Delivery Helper" and "Database Optimizer." Because they don't show up in the list, you need to look directly at wp-content/plugins/ on the server as files. The quickest route is to compare the number of plugins shown in the dashboard against the number of folders sitting there.

5. Rotate your passwords. Assume credentials were sent outside, and replace administrator passwords, database connection details and API keys for any external services.

Is this actually being exploited?

One more thing belongs in the record. Neither MonsterInsights nor Supsystic has told its users that a breach took place. For the former, the changelog for the fixed 11.0.0 is one line about various bug fixes and updates; for the latter, all there is is "unofficial version detected" in the free editions' changelogs. For the June CDN swap (OptinMonster and the others), each brand did put out an official statement — the responses have diverged.

On that count, the Fluent Forms case is the only one of the five where the scale of the damage exists as a number. About 295 accounts received it, 1,368 were notified, roughly 97.5% cleaned up as of August 7. Those numbers exist because the developer counted them and published them. That the equivalent figure is blank for the other four does not mean nobody was hit.

To sum up, in all five cases it is settled that malicious code really was distributed, and what remains unpublished is the scale of the damage beyond that point. Because this kind of attack sits dormant until an administrator logs in, an infected site looks no different from the outside. The absence of numbers does not mean there were no victims.

What to do

Start by listing the plugins you paid for. Everything affected here is a paid edition. Fluent Forms Pro goes to 6.2.8 or later (6.2.10+ recommended), Ninja Tables Pro to 5.2.13 or later (5.2.14+ recommended), MonsterInsights Pro to 11.0.0 or later, and the three paid Supsystic plugins to 1.7.0 / 2.11.1 / 1.10.1 or later. Premium SEO should be deleted.

Next, don't stop at updating. Work through the previous section — the version, the files, the database, the scheduled tasks, the user list, and rotating passwords. All five are the kind of attack that leaves traces once someone is inside, and in the Fluent Forms case the persistence lives in database rows and scheduled tasks rather than in files. Replacing the plugin changes none of that.

Then, if you can think of a plugin you installed without going through the official directory, work out where it came from. If you bought it directly from a developer, that developer is someone you are trusting — including on whether they are prepared to disclose a situation like this one. Anything whose origin you can't recall is safer deleted.

If you can run commands on your server, you can mechanically confirm that the files of plugins installed from the official directory have not been altered. WP-CLI, the command-line tool for WordPress, has a command called wp plugin verify-checksums --all that compares the file list published officially against the files you actually have. It does not work for paid editions, though, because there is no published list to compare against. Which is another way of saying that all five cases here sit squarely in that blind spot.

If you change one thing about how you operate, make it this: put an inventory of plugins installed from outside the official directory on a regular schedule. Knowing how many you have lets you decide in minutes whether news like this applies to you. Don't neglect updates to WordPress core either — two vulnerabilities allowing takeover without login landed in core in July, and those are on the U.S. government's list of flaws under active attack.

Summary

On August 14, the paid editions of Fluent Forms, the WordPress form builder, and Ninja Tables, a table builder from the same developer, each received a CVE number (CVE-2026-73532 / CVE-2026-73533, severity 9.8). Nothing was exploited through a hole in the code; the delivery channel was hijacked.

The cause was a server left running after the store platform moved. Proxy rules kept sending some update traffic to it, and whoever got in swapped the files it returned. The tampered builds went out for about five hours on July 31 and reached roughly 295 accounts. What was planted was a passwordless administrator entrance and persistence that survives deleting the plugin — database rows and scheduled tasks. Safe builds are Fluent Forms Pro 6.2.8 and later and Ninja Tables Pro 5.2.13 and later. Replacing the files is not the end of it: check whether apii.observer is still sitting in your database.

This article began with the three cases that received CVE numbers on August 7.

MonsterInsights Pro (CVE-2026-11976, severity 10.0) lost control of the storage bucket on Amazon's cloud that held its update files. A malicious file was mixed into 10.2.2 while it was being distributed, and the same file turned out to be in 10.2.0, the version rolled back to in response. As of the report, the attacker still retained write access. The safe version is 11.0.0 or later. For the three paid Supsystic plugins (CVE-2026-17032, 9.8), the update server was hijacked and even the automatic update destination was pointed at the attacker. Premium SEO (CVE-2026-14812, 10.0) was a plugin built for takeover in the first place, distributed without passing through the official directory. There is no fixed version.

Everything affected is a paid edition; the free editions in the official directory are not included. Paid editions get targeted because each vendor carries the burden of distributing updates itself. The "Update" button in the dashboard looks the same either way, but the screen never tells you whose hands the other end is in.

One layer deeper sits the fact that WordPress does not verify the authenticity of the update files it receives. The machinery for checking signatures was built in 2019, but the key's validity expired on April 1, 2021 and was never renewed, and the source code still carries a note to add key #2. In June 2024 the verification itself was disabled. All that is actually confirmed is that the connection is encrypted, and that counts for nothing if the party on the other end has been taken over.

Cases of the same shape keep coming. Gravity Forms in July 2025; three paid ShapedPlugin products in June 2026 (CVE-2026-10735) and MonsterInsights' sibling brands that same month; Fluent Forms and Ninja Tables on July 31. Four times in a year. What is in question is not any single company's lapse but the arrangement itself, in which every vendor distributes its own paid edition.

The responses diverged. Neither MonsterInsights nor Supsystic has told its users that a breach took place. WPManageNinja published the timeline, the cause, the victim count and a cleanup guide the next day, and says it is moving every plugin to checksum-based updating. Whether users can check their own situation turns out to depend not on how severe the flaw is, but on how much the developer is willing to say.

This kind of attack stays still until an administrator logs in, and an infected site looks unchanged. Applying the update and then checking for traces is what a real response looks like.

Frequently asked questions

I use the free version of Fluent Forms. Am I affected?

No. Only the paid edition (Fluent Forms Pro) was tainted; the free edition in the official WordPress directory is delivered through a different route. Other plugins from the same developer, such as FluentSMTP and FluentCRM, are not part of this incident either.

I never got an email from the developer. Am I in the clear?

The developer logs every download per customer and says it contacted everyone who downloaded on July 30 or 31; if you weren't contacted, you are almost certainly not affected. If you still want certainty, running the database query in this article (looking for rows containing apii.observer) settles it either way.

I installed the clean build. Am I done?

No. What was planted lives not only in the plugin's files but in database rows and scheduled tasks. Replacing the plugin leaves both untouched, and the developer states outright that installing the clean build does not complete the job. Run the database check.

My security plugin scanned the site and found nothing

That is not enough to go on. The developer itself writes that a clean scan is not proof you were not compromised. Reporting also indicates that the rogue administrator account adds itself to the existing security plugin's allowlist to suppress the alert. Checking by hand, using the steps above, is the more reliable route.

I use the free version of MonsterInsights. Am I affected?

No. What was tainted was the distribution of the paid edition (MonsterInsights Pro); the free edition in the official WordPress directory is delivered through a different route. That said, OptinMonster and others in the same family of brands were caught up in the June incident where CDN files were swapped. If you use any plugin from that family, WPForms and All in One SEO included, it is worth at least checking for hidden administrator accounts.

Would turning off automatic updates keep me safe?

In this particular case it might have spared you, but it isn't advisable. Most plugin vulnerabilities are ones that updating would have prevented, and switching updates off is far more dangerous. Handle cases like this one by checking for traces after updating, not by refusing to update.

Severity 10.0 — is it really that bad?

In substance, yes, it deserves a perfect score. No login and no password are needed, and if it lands, administrative control of the site goes straight to the attacker. But that number describes what happens if you actually downloaded one of the affected versions. Only specific versions of the paid editions are affected, so check the table first to see whether that includes you.

If this happened in June, why did the CVE numbers appear only now?

Because a researcher's report and the assignment of a number are separate processes. The MonsterInsights case was registered with WPScan on June 11 and the Supsystic case on July 24, and the CVE numbers were issued together on August 6 and 7. The events aren't new; the trackable numbers just arrived now.

What is tidio.cc? I use Tidio.

It is a domain set up by the attacker, unrelated to the Tidio chat tool (tidio.com). Keeping it one character away from a familiar name appears designed to stop anyone from feeling something is off while glancing at traffic logs. The more legitimately you use Tidio, the easier it is to miss, so check whether the ending is .cc or .com.

If I upgrade to a safe version, is that the end of it?

It isn't. Remember that 10.2.0, the version MonsterInsights rolled back to when it spotted trouble, was already tainted. With this kind of attack, the version the distributor believed was clean is not necessarily clean. On top of that, if an administrator account was created while the tainted build was running, updating leaves that account in place. Raise the version number, and then also work through the five steps in "checking whether your own site is infected" above.

Does WordPress really not check whether an update file is genuine?

It does not. The machinery for verifying cryptographic signatures was built in WordPress 5.2 back in 2019, but plugins and themes were left out from the start. On top of that, the key used for verification expired on April 1, 2021, and in June 2024 the verification routine itself was disabled. For plugins in the official directory a file list is published, and you can compare against it with WP-CLI's wp plugin verify-checksums — but WordPress core's update routine never looks there.

I updated, but the same thing keeps coming back

The Supsystic builds and the MonsterInsights 10.2.0 build both included a function that points update fetching at the attacker. In that state, you can update to what you believe is a clean version and still receive whatever the attacker prepared. Delete the plugin completely, then download the latest version again from the developer's own customer dashboard.

Sources

• ▸WPManageNinja - Security Incident on 31 July 2026 (the developer's own notice: timeline, indicators of compromise, cleanup steps)
• ▸WPManageNinja Community - Security incident 31 July 2026 (clean builds 6.2.8 / 5.2.13, customer Q&A)
• ▸NVD CVE-2026-73532 (Fluent Forms Pro 6.2.7, severity 9.8, CWE-506)
• ▸NVD CVE-2026-73533 (Ninja Tables Pro 5.2.11, severity 9.8, CWE-506)
• ▸VulnCheck - Fluent Forms Pro Embedded Malicious Code via Tampered Plugin Build (the assigning advisory)
• ▸Patchstack - Fluent Forms Pro Add On Pack 6.2.7 Backdoor (filed August 12, classified as already exploited)
• ▸The Repository - WPManageNinja Discloses Supply Chain Attack After Forgotten Server Delivers Tampered Plugin Updates (founder's comments, victim counts, remediation plans)
• ▸Fluent Forms changelog (6.2.7 on July 16, 6.2.8 on July 23, 6.2.10 on August 1; checked August 14, 2026)
• ▸WordPress.org - WPManageNinja plugin list (free-edition install counts checked August 14, 2026)
• ▸WPScan - MonsterInsights Pro 10.2.0/10.2.2 Compromised Update Distribution (CVE-2026-11976)
• ▸WPScan - Supsystic Multiple Pro Plugins Backdoor via Compromised Update Server (CVE-2026-17032)
• ▸WPScan - Premium SEO Malicious Plugin with Unauthenticated Backdoor (CVE-2026-14812)
• ▸NVD CVE-2026-11976 (MonsterInsights Pro, severity 10.0)
• ▸NVD CVE-2026-17032 (three Supsystic Pro plugins, severity 9.8)
• ▸NVD CVE-2026-14812 (Premium SEO, severity 10.0, no fix available)
• ▸Sansec - OptinMonster supply chain attack hits 1.2 million sites (research on the June CDN breach)
• ▸BleepingComputer - OptinMonster WordPress plugin hacked in CDN supply-chain attack
• ▸Patchstack - Tampered CDN Scripts Auto-Creating Rogue Admins (analysis of the administrator account names created)
• ▸heise online - Supply Chain Attack Puts 1.2 Million Sites at Risk
• ▸The Hacker News - Popular WordPress Plugin Scripts Tampered to Plant Hidden Backdoors
• ▸Security Affairs - Attackers compromised Awesome Motive CDN files
• ▸The Hacker News - ShapedPlugin WordPress Pro Plugins Backdoored (CVE-2026-10735, the same pattern in June 2026)
• ▸Patchstack - Critical Malware Found in Gravity Forms Official Plugin Site (the same pattern in July 2025)
• ▸WordPress Core - Security in 5.2 (introduction of signature verification for releases; plugins and themes excluded)
• ▸WordPress trunk - wp-admin/includes/file.php (key expiration in wp_trusted_keys() checked on August 7, 2026)
• ▸WordPress develop - the June 4, 2024 change that disabled signature verification
• ▸Paragon Initiative - WordPress 5.2: Mitigating Supply-Chain Attacks
• ▸WP-CLI - wp plugin verify-checksums (file comparison command for official-directory installs)
• ▸WordPress Core - Recommended usage of the Updates API (WordPress 5.5) (how self-distributed plugins specify their update URL)
• ▸WPScan - ShapedPlugin Multiple Pro Plugins Backdoor (CVE-2026-10735, mapping of tainted builds to fixed versions)
• ▸Gravity Forms - Security Incident Notice (official statement that automatic-update users were unaffected)
• ▸Patchstack - UpdraftPlus authentication bypass CVE-2026-10795 (the starting point of the June CDN breach)
• ▸MonsterInsights changelog (the 11.0.0 entry checked on August 7, 2026)
• ▸W3Techs - CMS share for Japanese-language content (as of August 6, 2026; WordPress 82.8%)
• ▸WordPress.org Plugin Directory (install counts, current versions and update dates retrieved from the official API on August 7, 2026)
• ▸CISA Known Exploited Vulnerabilities Catalog (August 6, 2026 edition, all 1,661 entries checked)