Law firm WordPress sites got three separate security fixes in the second half of October 2026.
TeamUpdraft, maker of the UpdraftPlus backup plugin, reported that an attacker got into its systems and used UpdraftCentral connections to add admin accounts and malicious plugins to connected sites. WordPress released 7.1.4, and PHP, the language WordPress runs on, patched two critical flaws.
A law firm site often carries intake forms, so a hacked site is a client-facing problem. Good law firm WordPress security this month means knowing which fixes apply and what to ask the developer or host to check.
A law firm WordPress site should be updated to UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium) or later, WordPress 7.1.4, and a patched PHP version.
Sites that were ever connected to UpdraftCentral also need to be checked for hidden admin accounts and hidden plugins, because TeamUpdraft says disconnecting does not remove anything already installed.
What Happened to WordPress Sites in Late October
The late October WordPress security news came from three sources.
- UpdraftPlus: TeamUpdraft found unauthorized access to its systems over the weekend of October 17 and 18, according to its security incident notice. It released fixed plugin versions 1.26.13 (free) and 2.26.13 (Premium) on October 19, which revoke old UpdraftCentral keys.
- WordPress 7.1.4: released October 28, 2026, addressing 22 vulnerabilities. WordPress.org recommends that sites update to WordPress 7.1.4 immediately.
- PHP: versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12, released October 21, fix two critical flaws that the PHP security advisory says “can allow unauthenticated remote code execution.”
Which Firms Need to Do More Than Update
The UpdraftPlus incident affects firms differently depending on how they used the plugin.
Firms that used UpdraftCentral
Firms that connected a site to UpdraftCentral, free or Premium, are the highest priority. TeamUpdraft says disconnecting “does not remove anything already installed on your site,” so every site that was ever connected should be checked.
Firms with a teamupdraft.com account or UpdraftVault
Firms with a teamupdraft.com account should change the password and reset two-factor login. UpdraftVault users must reconnect with new credentials.
Firms on the free plugin with no account
Firms running the free UpdraftPlus plugin with no teamupdraft.com account and no UpdraftCentral connection need no action beyond keeping the plugin updated.
TeamUpdraft says the plugin itself and backups stored in a firm’s own remote storage were not affected.
A Security Checklist to Hand the Firm’s Developer or Host
A law firm can pass this checklist, mostly from TeamUpdraft’s notice, to its site manager.
Today:
- Update UpdraftPlus, WordPress core and PHP, asking the host to confirm the PHP version.
- Confirm no UpdraftCentral keys remain under Settings, UpdraftPlus, Advanced Tools, UpdraftCentral.
- Check the plugins folders directly through the host’s file manager or SFTP. Malicious plugins can hide from the Plugins screen.
This week:
- Check for hidden administrator and editor accounts outside the dashboard, since some plugins hide accounts from the Users screen.
- Do not delete a suspicious plugin from the dashboard. TeamUpdraft says some “contain mechanisms designed to remove evidence when deleted through WordPress.” Deactivate it, then remove its folder directly.
- Rotate the site’s security keys to end existing logins, then change passwords for real admin and editor accounts.
- If anything looks wrong, restore from a backup taken before October 17.
TeamUpdraft’s October 29 update explains why every step matters: a plugin left behind by the attacker later created a new admin account on a site that had already been disconnected.
If the Site Has to Go Offline During Cleanup
Taking a law firm site offline for cleanup can hurt its search presence if done wrong. Google’s guidance on temporarily pausing a website gives the safe approach.
- For a closure of one to two days, return a 503 status code with a retry-after header.
- Do not return 403, 404 or 410 codes, block all crawling in robots.txt, or add noindex. Each can remove pages from Search.
- Do not return a 503 for the robots.txt file itself, which blocks all crawling.
- For longer closures, use an indexable placeholder home page.
A hacked site is a different problem from comment spam, which is handled by moderating law firm blog comments.
Frequently Asked Questions
A law firm using only the free UpdraftPlus plugin, with no teamupdraft.com account and no UpdraftCentral connection, needs no action beyond updating to version 1.26.13 or later. TeamUpdraft says the plugin itself was not affected.
Updating UpdraftPlus is not enough for a site that was connected to UpdraftCentral. The update revokes old keys, but TeamUpdraft says disconnecting does not remove anything an attacker already installed, so plugin folders and user accounts need a hand check.
A firm should not delete a suspicious plugin from the WordPress dashboard because TeamUpdraft says some are built to erase evidence when removed that way. The safer order is to deactivate the plugin first, then delete its folder directly through the host’s file manager or SFTP.
A law firm can take its website offline briefly during cleanup by returning a 503 status code with a retry-after header, which Google recommends for one to two days. For longer closures, Google suggests a placeholder page instead.
- UpdraftPlus 1.26.13 (free) and 2.26.13 (Premium) revoke old UpdraftCentral keys, but sites that were connected still need a manual check.
- WordPress 7.1.4 and the October 21 PHP releases each fix security flaws and should be applied.
- Malicious plugins and accounts can hide from the dashboard.
- A brief cleanup shutdown should return a 503 with a retry-after header.
Keeping Law Firm WordPress Security Current After October
Law firm WordPress security this month comes down to three updates and one hands-on check. Update UpdraftPlus, WordPress and PHP on every site the firm runs. Then, if the site was ever connected to UpdraftCentral, have someone look at the plugin folders and user accounts by hand, because a clean-looking dashboard is not proof of a clean site.
Once the site is secure, review the pages and forms potential clients use most. Lexicon’s legal content experts handle blog posting and on-site optimization for law firm WordPress sites, so new content goes up cleanly and consistently. A quick call to (877) 486-8123 is enough to talk through what the site needs next.
