Attackers stopped hitting one site and started poisoning the distributor. State of WordPress 2026, WP Beacon Essential Plugin hijacks, Fluent Forms / Rank Math PRO / MonsterInsights / ShapedPlugin / WowShipping Pro update-channel compromises, and Sansec OptinMonster-style upstream JS are the public cases. Bedrock watches the update path and fake Woo plugins. It cannot rewrite every CDN script. It is not bulletproof.

The scanner looks for unexpected update hosts, remote unserialize gadgets, Ethereum RPC C2 strings, fake WooCommerce companion folders, Adminer and Tiny File Manager, wp-config.php append after wp-settings.php, leftover 2FA and mail-queue tables, and filters that force auto-updates off.

Stop skilled attacks also blocks a sudden package-host change, quarantines fake Woo companions, and requires a recent Users-screen visit before REST can create a user. Zip-install lock from 2.1.56 stays. Application passwords and WP-CLI still work.

After a finding, delete the dropper and the second-stage plugin. Rotate every administrator password, 2FA seeds, and the WordPress salts. Download Pro zips from the vendor dashboard, not an old CDN. Treat upstream JS vendors as a trust boundary.

We cannot vouch for every wordpress.org author forever. A perfect vendor-signed evil update that looks identical to a real one can still land. You never change DNS. Read the short note or Ask for a $199 cleanup.