WordPress Plugin Security: What Small Businesses Should Do

If your Fort Wayne business has a website, there’s a good chance it runs on WordPress — and a good chance one of its plugins just made the security news. In mid-October 2026, security researchers flagged two separate flaws in All in One SEO (AIOSEO), a plugin that runs on more than two million WordPress sites, according to Search Engine Journal’s reporting.¹

So here’s the honest version before we go any further: if your site auto-updates and you’re on the current release, this particular story is a non-event for you. We’ll show you how to confirm that in about ten minutes. But the AIOSEO flaw is a useful teaching moment, because the real way small businesses get hacked is almost never a brand-new, headline-grabbing exploit. It’s the site that was built once, years ago, by a contractor nobody can reach anymore — the one that hasn’t had an update in eighteen months and has no backups. That’s the problem worth your attention — and it’s part of the real cost of owning a website, which we break down in our 2026 Fort Wayne website pricing guide.

What happened with the All in One SEO plugin?

Two vulnerabilities were disclosed in AIOSEO, both rated Medium severity. Neither is the kind of catastrophic, drop-everything flaw that lets someone instantly take over your whole site — but both are worth understanding because of one shared trait: they’re unauthenticated.

The first, tracked as CVE-2026-100152, is an unauthenticated arbitrary shortcode execution flaw rated 6.5 (Medium). It affects all AIOSEO versions up to and including 5.0.2 and is fixed in 5.0.2.1. Per the security firm Wordfence, whose analysis Search Engine Journal cites, it only becomes exploitable when the plugin’s breadcrumbs are rendered on a WordPress search-results page.¹ The second, CVE-2026-85492, is an unauthenticated DOM-based cross-site scripting (XSS) flaw rated 6.1 (Medium), affecting versions up to and including 5.0.1.1 and fixed in 5.0.2. That one has a narrower trigger: a logged-in user with SEO-management permissions has to open the plugin’s SEO Preview panel while visiting a specially crafted URL. Visiting the bad link alone isn’t enough.

The fix for both is the same: update to 5.0.2.1 or newer. As of this writing the plugin’s current release is 5.0.3, according to its WordPress.org plugin page,³ so a site on the latest version is covered. Worth saying plainly: AIOSEO is a reputable plugin that patched both issues promptly. This isn’t a story about a bad plugin. It’s a story about what happens on sites that never install the patch.

What does a “plugin vulnerability” actually mean?

In plain English: WordPress itself is the engine, and plugins are the add-ons that make it do specific jobs — SEO, contact forms, booking, online payments. Each plugin is software written by a third party, and like all software, it occasionally has bugs. A vulnerability is a bug that a malicious person can abuse to do something they shouldn’t — inject code, read data, or hijack a visitor’s browser session.

The scary word in both AIOSEO advisories is unauthenticated. Most people assume a hacker has to “break in” first — guess a password, get past a login. An unauthenticated flaw skips that step: the attacker needs no account and no credentials to attempt it. That’s why security teams and the Wordfence vulnerability database weight unauthenticated issues more heavily, even at a Medium severity score.² The flip side, and the reason not to panic here, is that both AIOSEO flaws still need specific conditions to line up before they do anything — and the patch removes the condition entirely.

This matters for a local business because of scale. Automated bots constantly scan the entire web for known-vulnerable plugin versions. They don’t care whether you’re a Fortune 500 or a two-truck HVAC shop in New Haven — they care only whether your plugin version matches a flaw they know how to exploit. That’s also why an unmaintained site is the real exposure: it’s not that attackers target you, it’s that they target a version number, and an un-updated site keeps that version number sitting out in the open for months.

Do you need to do anything right now?

For most readers, honestly, no — and we’d rather tell you that than scare you into a service call. Here’s the ten-minute self-check:

1. Log into your WordPress admin (usually yoursite.com/wp-admin). If you don’t know the login, that’s finding #1 — write it down and skip to the maintenance section below.
2. Go to Plugins. Look for All in One SEO. If the version is 5.0.2.1 or higher, you’re protected against both flaws covered here. Done.
3. Check whether auto-updates are on. On the Plugins screen there’s an “Enable auto-updates” link next to each plugin. If it already says “Auto-updates enabled,” your site most likely patched itself before you ever read this.
4. While you’re there, glance at every other plugin for an “Update available” notice. The AIOSEO fix is today’s headline; the three other outdated plugins are tomorrow’s.

If all of that checks out, close the tab and get back to running your business. You do not need to buy anything. The only people who do need to act today are those running an AIOSEO version below 5.0.2.1 — and the action is free: click update.

The honest WordPress maintenance checklist

The AIOSEO episode is really a prompt to answer a bigger question: is anyone maintaining this site at all? The official WordPress hardening guide runs long and technical, but for a small business the baseline that prevents the overwhelming majority of real incidents is short:⁴

That last row is the one most businesses skip, and it’s the one that actually matters. Tools don’t maintain themselves; a person clicks update, checks the backup ran, and reads the scanner alert. The WordPress handbook also recommends keeping unused software off the site entirely and only installing plugins from trusted sources — advice that pairs well with the question of whether an AI agent can even use your website cleanly, since a bloated, half-broken site fails both humans and machines. If you’re planning a refresh anyway, our guide on website redesign vs. rebuild walks through when a tidy-up is enough and when it’s time to start over.

When a managed plan — or a simpler build — is the honest answer

Here’s where we tell you when you do need help, and when you don’t. If your site is a straightforward brochure site — a handful of pages, your services, a contact form — and someone on your team will genuinely keep auto-updates on and backups running, you may not need a paid maintenance plan at all. Good for you; keep it lean.

But if your site takes bookings or payments, has a dozen-plus plugins, or — be honest — hasn’t been touched since it launched, a maintained plan earns its keep. What you’re paying for isn’t magic; it’s the named-person-responsible row in that table, plus someone watching the firewall and testing that the backup actually restores. For some simple brochure sites, the honest answer is different again: a lighter, non-WordPress build has far fewer moving parts to patch — fewer plugins, fewer updates, less to go wrong — which is one reason we sometimes steer a simple brochure-site client that way. A modern site also has a new job in the AI search era — and a site that’s down or defaced does that job for nobody.

One more honest note on timing: if a site does get compromised and you have to clean it up, recovery isn’t instant. The same patience that applies to how long Google takes to crawl, index, and rank a site applies to earning trust back after downtime. Prevention is simply cheaper than recovery.

What we see across Fort Wayne and Northeast Indiana

We get called about this pattern constantly across Fort Wayne, Allen County, and out into DeKalb County: a site built once, by a contractor or a nephew or a now-defunct agency, five or six years ago. The owner has never logged into the admin. There are no backups. Nobody knows which plugins are installed, let alone whether they’re current. It runs fine — right up until the afternoon it doesn’t, and then there’s no one to call and nothing to restore from.

None of that is unique to WordPress, and none of it is a reason to feel foolish. Most owners we meet are excellent at their actual trade — HVAC, dental, restaurants, manufacturing, logistics — and a website quietly rotting in the background is simply nobody’s job. That’s the whole problem in one sentence.

So here’s a genuinely free, ten-minute local self-check you can run this week: (1) confirm you can log into your own site’s admin; (2) find out whether auto-updates are on; (3) confirm a backup exists and that someone could actually restore it; and (4) write down one name — the person responsible for all of the above. If you can’t complete even step one, that’s not an emergency, but it is a gap worth closing before it closes itself for you.

Get a straight answer on your site’s health

If that self-check turned up more question marks than you’d like, we’re happy to look. We offer a plain-spoken security and maintenance checkup for Northeast Indiana businesses: we tell you what’s outdated, whether your backups actually work, and whether you need a maintenance plan or just need to flip on auto-updates — and if it’s the latter, we’ll say so. No fear-based upsell. You can see how we approach builds and upkeep on our web development services page, or just reach out and describe your site.