WordPress Patch Roundup September 2026: Plugins to Update

Several of the most widely installed WordPress plugins shipped security fixes in September 2026. The monthly Sucuri vulnerability patch roundup lists issues in WooCommerce, LiteSpeed Cache, WPForms, All-in-One WP Migration and Backup, Rank Math SEO and UpdraftPlus.

If you run any of these plugins, check your installed versions and update. Only one independent publisher covers this story so far, so treat the details below as that publisher's account. Severity ratings are Sucuri's own labels, not CVSS scores, and the published text we could read was cut off partway through the list.

What the September roundup lists

The table below summarizes the entries visible in the source. Risk is Sucuri's rating. The source's list continues past the UpdraftPlus entry, but the text available to us ends there, so other plugins may have been covered.

Sucuri reports install counts of 7,000,000+ for WooCommerce and LiteSpeed Cache, 5,000,000+ for WPForms and All-in-One WP Migration, and 4,000,000+ for Rank Math SEO. At that scale, even issues rated Low or Medium reach a very large number of sites.

What these weakness types mean

The entries fall into a few familiar classes. Knowing them helps you decide what to do first.

• Unauthenticated issues need no login. Anyone on the internet can attempt them, which is why they usually come first in patch priority. Examples here: the WooCommerce denial of service, the WPForms shortcode execution and the Rank Math information exposure.
• Authenticated issues need an account. The WooCommerce SQL injection requires Shop Manager or higher, and the UpdraftPlus information exposure requires Subscriber or higher. They matter most on sites that allow open registration or have many staff accounts.
• Reflected cross-site scripting (XSS) runs attacker-supplied script in a visitor's browser, typically after they follow a crafted link. The LiteSpeed Cache and WPForms XSS entries are this type.
• Missing authorization and privilege escalation mean a plugin action does not properly check who is allowed to use it.

Who is realistically exposed

Exposure depends on the installed version, not on the plugin alone. Online stores running WooCommerce 10.9.4 or older are in the range for the SQL injection, and anything below 11.1.0 is in the range for the denial of service. Sites using WPForms 2.0.2 or older should assume they are in range for at least one of the three WPForms entries. Sites using Rank Math SEO below 1.0.277 are in range for the information exposure.

Authenticated issues are lower risk on small sites with only trusted administrators. They are higher risk where untrusted people can obtain Subscriber, Contributor or Shop Manager accounts.

How to check your versions

This read-only WP-CLI command lists installed plugins with their status and version. Run it from your WordPress root and compare the version column against the fixed versions in the table.

wp plugin list --fields=name,status,version,update_version

To check a single plugin, for example WooCommerce, this read-only command prints its version.

wp plugin get woocommerce --field=version

Without command-line access, open Plugins, then Installed Plugins in the WordPress dashboard and read the version under each plugin name.

What to do now

This command updates a single plugin to the latest available release. Run it from the WordPress root after taking a backup, and confirm the new version afterward with the listing command above.

wp plugin update litespeed-cache

Detection and monitoring afterwards

Patching closes the known hole but does not tell you whether it was used before you updated. The source does not report active exploitation, so there is no confirmed indicator to hunt for. General checks are still worth doing after a large update round.

• Look for administrator or shop-manager accounts you do not recognize.
• Review recently modified files and new scheduled tasks.
• Watch web server logs for repeated requests to form endpoints and unusual query strings.
• Run an outside-in scan to spot injected scripts or defacement. The free malware scanner is a quick starting point, and the guide on what outside-in detection can and cannot see explains its limits.

For a repeatable routine, see the WordPress security checklist and the guide on checking whether a plugin is vulnerable. A web application firewall can add a layer in front of a site while you schedule updates, but it is not a substitute for patching.

Background: the August 2026 roundup

The previous August 2026 roundup from the same publisher covered LiteSpeed Cache and All-in-One WP Migration and Backup too. It listed, among others, an unauthenticated stored XSS in LiteSpeed Cache fixed in 7.9 and an unauthenticated second-order SQL injection leading to remote code execution in All-in-One WP Migration and Backup fixed in 7.110. Because both plugins appear in two consecutive months, a site that skipped August updates is exposed to more than the September list. Updating straight to the versions in the table above covers both months.

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

1. Vulnerability & Patch Roundup — September 2026blog.sucuri.net · 1 October 2026
2. Vulnerability & Patch Roundup — August 2026blog.sucuri.net · 1 September 2026

• WordPress
• plugins
• patch roundup
• WooCommerce
• LiteSpeed Cache
• WPForms