How to Update WordPress Plugins Safely in 2026 (Guide)

Introduction

Four widely used WordPress plugins were found to contain critical authentication-bypass flaws — all rated CVSS 9.8, the highest severity — disclosed on October 1, 2026. Each flaw lets an attacker who has never logged into your site take over an administrator account, with no password required. If your small business runs on WordPress, this is the moment to learn how to update WordPress plugins safely in 2026: this post breaks down what each flaw does, lists the fixed versions, and walks you through a step-by-step checklist to patch your site without breaking it.

The 4 Plugins With Critical Login-Bypass Flaws

Security researchers disclosed the four flaws on October 1, 2026, with the CVE records published the following day, per an independent analysis by ThreatAft. All four let an unauthenticated visitor become a full administrator of an affected site:

Plugin	Affected versions	CVE	Fixed in
DevKit Pro	≤ 2.3.0	CVE-2026-14378	2.3.1 (developer recommends 3.0.0+)
Divi Membership	≤ 2.3.0	CVE-2026-19660	3.0.0
JSON API Auth	≤ 3.1.2	CVE-2026-97637	3.1.3
WPMobile.App	≤ 11.82	CVE-2026-94541	11.85

1. DevKit Pro (CVE-2026-14378)

A development toolkit plugin. Its user-switching feature trusted a browser cookie (named original_user_id) to decide who was requesting an admin session, and the switch-back form with a valid security token was rendered on public pages — visible to anyone, including visitors who were never logged in. An attacker could set that cookie to an administrator’s user ID, collect the token, and be granted a full admin session. The flaw is rated CVSS 9.8 (TheHackerWire), and a public proof-of-concept exploit with mass-scanning capability is already circulating (VulnSea). Update to 2.3.1 at minimum; the developer recommends moving to 3.0.0 or later.

2. Divi Membership (CVE-2026-19660)

A membership plugin in the Divi ecosystem. It trusted a base64-encoded paypal_param value passed in the page URL without verifying it against PayPal, which made it possible to log in as any user — including administrators. Shield Security’s October 2026 vulnerability roundup lists it as a 9.8 privilege-escalation flaw and advises updating to version 3.0.0 or later (Shield Security). If you run a membership or subscription site on Divi, treat this as your top priority.

3. JSON API Auth (CVE-2026-97637)

A plugin that provides JSON-based authentication for WordPress (commonly used by mobile apps and headless sites). Its login endpoint cached the generated session cookies keyed only by the request URL, so a valid administrator session cookie could be served to an unauthenticated visitor’s plain GET request. Rated CVSS 9.8 and disclosed October 2, 2026 (TheHackerWire). Update to version 3.1.3. Note: the same plugin appears in the WP Sentry September 27–October 4 vulnerability report as a critical authentication bypass.

4. WPMobile.App (CVE-2026-94541)

A plugin that builds Android and iOS apps from WordPress sites. Its mail-to-push feature could be abused by unauthenticated attackers to extract password-reset URLs, enabling an administrator account takeover (CVEFeed). Update to version 11.85. This is the one attackers are already probing: Wordfence blocked 137 attacks targeting WPMobile.App alone in a single 24-hour window, per the ThreatAft analysis.

What “Login Bypass” Actually Means for Your Business

“Login bypass” sounds technical, but the business impact is simple: an attacker becomes you. With an administrator session, they can install malware, redirect your checkout to their own payment page, steal your customer list, lock you out by changing your password, or use your server to attack others — all while your site looks normal to visitors.

Two facts from this cluster should sharpen your urgency. First, attacks are already happening: Wordfence blocked 137 attempts against WPMobile.App sites in 24 hours. Second, a public exploit with mass-scanning capability exists for the DevKit Pro flaw, which means attackers can hunt for vulnerable sites automatically rather than one by one. This is also the second major WordPress security disclosure in a week — last week’s critical flaw landed on CISA’s known-exploited list — so patching is the only fix; no settings change closes these holes. If you manage several client or department sites, check every one of them, not just the site you log into daily.

How to Update WordPress Plugins Safely in 2026: The Checklist

Rushing a security update can break your site; ignoring it can lose it. The safe path takes about 30–45 minutes for a typical small-business site. Follow the steps in order.

Step 1: Inventory your plugins

In your WordPress dashboard, go to Dashboard → Updates and Plugins → Installed Plugins. Write down which plugins show an available update, and check the four plugins above by name — even deactivated plugins matter here, since vulnerable code can often still be reached.

Step 2: Back up files and database first

Before touching anything, create a full backup: both the site files and the database. The official WordPress documentation has long recommended a complete backup before upgrades so you can restore if something goes wrong. Confirm the backup actually completed — a backup job can silently fail when your hosting account is near its storage quota. This backup is your rollback plan.

Step 3: Look for signs you may already be compromised

Before updating, scan for red flags: administrator accounts you don’t recognize under Users → All Users, plugins you didn’t install, and recent file changes you didn’t make. If you run any of the four vulnerable plugins and find an unfamiliar admin account, assume the site was breached and treat this as incident response (update, remove the rogue account, reset all admin passwords, and have a professional review the site), not a routine update.

Step 4: Update the four critical plugins first

Security patches take priority over feature updates. Update these to at least their fixed versions: DevKit Pro → 2.3.1 (or 3.0.0+), Divi Membership → 3.0.0, JSON API Auth → 3.1.3, WPMobile.App → 11.85. If a plugin you use has no patch yet, deactivate it until one ships — an unused or unpatched plugin is not worth the risk. This matches the wider professional workflow: apply security-critical updates first, review the rest manually (Ajay Khandal’s 2026 WordPress update guide).

Step 5: Update remaining plugins one at a time

Don’t hit “update all.” Update one plugin, wait for it to finish, and move to the next. Updating in bulk makes it nearly impossible to tell which update broke something if your site misbehaves afterward. Work from the most security-sensitive plugins (security, backup, e-commerce, membership) toward the cosmetic ones (sliders, galleries).

Step 6: Test your key pages

After each meaningful update, check what your customers actually use: the homepage, contact form, checkout flow, and login page. Don’t just confirm the site loads — submit the form and click through a purchase path. WordPress enters a brief maintenance mode during core updates, but plugin updates shouldn’t produce visible downtime.

Step 7: Audit admin accounts and rotate passwords

Now that you’re patched, go to Users → All Users and delete any account you can’t identify. Then change your own administrator password and have other admins do the same — especially if any of the four vulnerable plugins was installed while the flaw was public. Enable two-factor authentication for every administrator account; stolen passwords are the cheapest way into any site (this 2026 WordPress hardening checklist covers the same ground).

Step 8: Turn on auto-updates for security releases

You don’t need to repeat this scramble. In Plugins → Installed Plugins, use the “Enable auto-updates” link per plugin for well-maintained, security-sensitive plugins (your security plugin, backup plugin, e-commerce core). Well-reviewed guidance for 2026 recommends auto-updates for security-critical plugins while reviewing bigger updates manually — and for a high-traffic store, waiting 48–72 hours after a non-security release lets early adopters surface breaking changes before you.

Common Mistakes to Avoid

• Updating everything at once. One-at-a-time updates take longer but turn a mystery outage into a five-minute rollback.
• Skipping the backup because “it’s just a plugin.” Plugin updates are the single most common cause of sudden WordPress breakage; the backup is cheap insurance.
• Assuming you’re safe because the site looks fine. A compromised admin account looks exactly like a normal one until it’s used. Audit users, don’t eyeball the homepage.
• Leaving auto-updates on for everything. Page builders and large plugins with complex codebases can break layouts on auto-update. Reserve auto-updates for security-focused plugins.
• Updating from your phone on public Wi-Fi. Do admin work — especially updates and password changes — from a trusted connection.

Frequently Asked Questions

Sources

Last checked October 8, 2026. Vulnerability details: ThreatAft — WordPress 4 CVEs: CVSS 9.8 Auth Bypass Cluster; TheHackerWire — CVE-2026-14378; TheHackerWire — CVE-2026-97637; VulnSea — CVE-2026-14378; Shield Security — ShieldNOTES 128; CVEFeed — CVE-2026-94541; WP Sentry vulnerability report. Update best practices: Ajay Khandal; Dev.to hardening checklist.

Conclusion

Four plugins, four CVSS 9.8 login-bypass flaws, one lesson: plugin updates are not optional maintenance — they’re your site’s front door. Update DevKit Pro, Divi Membership, JSON API Auth, and WPMobile.App to their fixed versions today using the checklist above, audit your admin accounts, and turn on auto-updates for your security-critical plugins so the next disclosure doesn’t become your emergency. The same urgency applies to WordPress core: the WordPress 7.1.1 security update, released just weeks before these plugin flaws were disclosed, patched the Click2Shell attack chain and ten more vulnerabilities. October’s WordPress 7.1.3 security update closed seven more core flaws. If you run your business blog on WordPress, this kind of regular maintenance is part of what keeps it ranking and safe. October’s plugin-security wave didn’t stop with these four — the Ninja Forms hack planted hidden admin accounts through a form plugin, and the Events Manager 7.4.7 security update closed a CVSS 8.5 SQL injection. Both were fixed the same way: update promptly. Keeping your server’s PHP version current is part of the same routine — see our guide on how to update the PHP version on your WordPress site before the December 31 deadline.