What every church and nonprofit with a WordPress website should check this week
Criminals are running automated tools that scan tens of thousands of websites an hour, testing each one for outdated plugins. Your church site is in the scan whether it was ever deliberately targeted. This week, two critical vulnerabilities in widely-used WordPress plugins are being actively exploited.
Most church and nonprofit websites were built to share news, announce events, and collect newsletter sign-ups. Security updates were often an afterthought — if they were considered at all. This month, that gap became urgent.
Two critical flaws in widely-used WordPress plugins are being actively exploited right now. Separately, a criminal operation documented this month used automated software tools to scan more than 56,000 WordPress and e-commerce websites in a matter of hours, test each one for weaknesses, and compromise hundreds of them in rapid succession. The tools do not know or care whether a site belongs to a large corporation or a small rural church. They scan everything they can reach.
What happened this month
Security researchers at Patchstack disclosed a vulnerability in a popular WordPress page-builder add-on called Bricksforge. The flaw — assigned the maximum possible severity score of 10.0 on a 10-point scale — allows an attacker to run any code they choose on your web server without needing a username or password. Exploitation attempts were observed starting October 7, 2026, originating from dozens of different addresses. The only fix is a plugin update to version 3.1.8.10.
At the same time, researchers published findings on a criminal group called CyberXero, which used automated tools to scan more than 56,000 WordPress and e-commerce websites in a short timeframe, confirmed unauthorized access to 429 administrator panels, and deployed malicious files in a 61-second automated run. That campaign exploited a flaw in the Support Board plugin — a chat and support tool used by some churches and small businesses — as well as two vulnerabilities in a plugin called wp2shell. The operation resulted in more than 628,000 records stolen.
Neither event required a human attacker to select a specific organization. The tools work by volume and speed, not by targeting.
Why your site is in the scan whether you were targeted or not
WordPress powers roughly 40 percent of every website on the internet, according to web technology researcher W3Techs. That dominance is precisely why churches, nonprofits, and community organizations tend to use it — the platform is free, the themes and plugins are inexpensive, and volunteers with limited technical experience can manage a site. It is also why criminals write tools specifically designed to scan WordPress sites at scale.
When an automated scanner finds a vulnerable plugin, it does not weigh the size of the organization, estimate the value of the stored data, or consider whether the site has ever been mentioned in public. It exploits what it finds. A small church's website with an outdated plugin is as accessible as any other — and a church site often stores years of member contact information, registration records, and giving history that has real value to a criminal.
What an attacker does once they get in
Gaining access to a WordPress administrator panel is the beginning of an attack, not the end. A common first step is installing a "web shell" — a small file that gives the attacker a persistent back door into the server, one that survives a password change or even a WordPress reinstall if the file is left in place.
From that position, an attacker can:
- Redirect visitors to fake donation pages or credential-harvesting sites without changing anything visible on your end
- Collect the email addresses, phone numbers, and names of anyone who ever filled out a form on your site
- Use your server to send spam, host scam pages, or run attacks against other organizations — damage that can result in your domain being flagged or your hosting account suspended
- Wait quietly for months before doing anything noticeable, watching for financial communications or staff credentials that arrive by email
Small sites are not protected by being small. They are vulnerable for exactly the same reason large sites are: an outdated plugin on a widely-deployed platform.
What to do
- Log in to your WordPress dashboard and go to Plugins → Installed Plugins. Look for any plugin with a yellow "Update available" banner. Update every one today. This takes about five minutes and closes the most common entry points immediately.
- If your site uses Bricksforge, update to version 3.1.8.10 immediately. This is the only protection against CVE-2026-85097. There is no configuration change or setting that provides an alternative — only the patch closes the flaw.
- If your site uses Support Board (a chat or customer-support plugin), verify that you are running the latest available version, which addresses the SQL injection vulnerability exploited this month.
- Update WordPress core separately. Plugin updates and WordPress core updates are two different steps. Your dashboard will show a notice at the top if a core update is available — do not skip it.
- Turn on automatic plugin updates where possible. In Plugins → Installed Plugins, you will see an "Enable auto-updates" link next to each plugin. Enabling this does not eliminate all risk, but it closes the gap between when a security patch is published and when your site is protected — which this month was a matter of hours.
- Confirm your most recent backup. If you are unsure when your site was last backed up, log in to your hosting control panel today and either schedule one or install a backup plugin such as UpdraftPlus. A clean backup from before an attack is the only reliable recovery point.
- If you use a managed WordPress host — WP Engine, SiteGround, Kinsta, Flywheel, or similar — contact their support and ask whether the Bricksforge CVE-2026-85097 patch has been applied to your account. Managed hosts often apply critical patches automatically, but it is worth confirming rather than assuming.
- If nobody is currently responsible for your site, assign the job this week. A church website with no designated maintainer is a site no one will notice has been compromised. Even a brief quarterly checkin — log in, apply updates, verify a backup exists — is far better than none.
Related reading
- Email security checklist for small organizations — a step-by-step guide to the settings every church and nonprofit should enable, who should own them, and how to respond if something goes wrong.
- Email security for nonprofits and faith-based organizations — the protections that stop the most common attacks on church staff inboxes, in plain terms.
- What Family Sentinel monitors for — including the follow-on phishing and credential-harvesting emails that often arrive in staff inboxes after a website has been compromised.
Website compromise often leads straight to inbox fraud.
When a church or nonprofit website is taken over, attackers frequently pivot to the organization's email next — sending fake payment-change requests, donation appeals, or staff credential phishing from infrastructure they now control. Family Sentinel's Org Guard monitors your organization's email environment for exactly these follow-on attacks. A free 20-minute checkup is a good place to start: we review your email authentication posture and tell you what we see.
Book a free 20-minute checkup →Want the next threat before it reaches you?
Scam Watch goes out regularly — the newest scams and how to spot them, in plain English. Free.