Imagine this. You are logged into your WordPress website, sorting out a page or checking an order, and you click a link in another tab. A familiar-looking security check pops up: “Just a moment.” You wait. Nothing seems to happen. You carry on with your day.
Behind that innocent-looking screen, something may have just used your own login to break into your website — without ever asking for your password. That is the unsettling idea behind a new WordPress attack chain revealed today, 27 October 2026, and it is one every business owner with a WordPress site should know about.
What happened today
Security researchers at Securonix have documented a campaign they call TRUST#GRAFT. It was reported by Cyber Security News on 27 October 2026. Unlike the PHP2Shell flaw that dominated headlines last week, this is not a bug in the software itself. It is a trick that abuses something far more human: the fact that you are already logged in.
The attack begins with a fake Cloudflare verification screen — the kind of “Just a moment” overlay most of us click past without thinking. While that screen is showing, a hidden script quietly studies your browser: your screen size, your timezone, even whether you look like a real person or an automated test. If it decides you are worth targeting, it checks whether you have WordPress admin access open in your browser.
If you do, it uses your own signed-in session to upload a plugin called “Web Media Optimizer” version 2.1 and switch it on. No password is typed. No login screen appears. The plugin then plants a hidden backdoor in your site’s files, giving the attacker a way back in whenever they want.
Why this is different — and scarier — than last week’s scare
Last week’s PHP2Shell story was about a flaw in PHP, the engine underneath WordPress. The fix was technical: update PHP and move on. This new attack targets the person, not the server. Your password can be long and complicated, your plugins can be fully updated, and you can still be caught — because the attacker never needed to break in. They simply rode in on a session you had already opened.
That is why this matters even for small sites. Attackers do not only chase big companies. A small business website is often easier precisely because one person does everything: they run the site, answer emails, and browse the web, all in the same browser, all while still logged in as admin.
What could it cost you?
A hidden backdoor is not a smashed window you notice straight away. It is a copied key. While it sits there, criminals can steal customer details, redirect your visitors to scam pages, send spam from your domain, or use your respectable business website to attack others. By the time Google flags your site or a customer complains, the damage to your reputation may already be done — and cleaning up a hacked site properly takes time, money, and stress no small business needs.
Five things to do today
1. Log out of WordPress when you are done
This is the single most effective habit against this attack. If you are not logged in, there is no session to abuse. Get into the routine: finish your website work, log out, and only log back in when you need to.
2. Keep admin work in its own browser
Use one browser — or one browser profile — only for managing your website, and do your everyday browsing, email, and social media somewhere else. That way a dodgy page in your casual browsing can never reach your admin session.
3. Treat “Just a moment” screens with suspicion
Real Cloudflare checks exist, but a verification screen that appears on a strange site, freezes your page, or feels out of place is a warning sign. If a page looks wrong, close the tab. Do not wait for it to finish.
4. Check your plugins — including the hidden ones
Look in your WordPress dashboard under Plugins for anything you do not recognise, especially anything called “Web Media Optimizer”. Also ask your developer or host to check the mu-plugins folder, where this attack plants its backdoor. Anything unfamiliar there should be investigated, not ignored.
5. Turn on two-factor authentication and keep backups
Two-factor authentication adds a second lock to your login, and a recent, tested backup means that even in the worst case you can restore a clean copy of your site quickly. Both are simple, and both are worth far more than they cost.
Frequently asked questions
Does this attack steal my WordPress password?
No — and that is the point. It does not need your password at all. It reuses your already-logged-in browser session, which is why logging out and separating your admin browsing matter so much.
Is my site safe if all my plugins are updated?
Updates are essential, but they do not stop this attack, because nothing here exploits an outdated plugin. Good update habits plus good login habits together are what protect you.
How do I know if my site has already been hit?
Look for plugins you did not install, new admin users you did not create, and unexpected files in your mu-plugins folder. If anything looks unfamiliar, get it checked by a professional before it spreads — and change your admin passwords as a precaution.
The bottom line
The most dangerous attacks are not always the loud ones. This one works precisely because it looks boring: a routine verification screen, a session you opened yourself, a plugin with a forgettable name. The defence is equally unglamorous — log out, separate your browsing, and check what is installed on your site. Small habits, done consistently, are what keep a small business website safe.
Not sure whether your website is as secure as it should be? Altus Web Solutions offers a free website audit — we will check your site honestly and tell you what is helping you and what is putting you at risk. Email us at [email protected] to claim your free audit.
