What to look out for today
1) WordPress sites at risk of takeover via a plugin: Reports say attackers are actively targeting WordPress websites running certain versions of the WP Maps Pro plugin to create new administrator accounts.
2) Breach ripple effects driving scams: Fresh legal action related to the earlier 23andMe breach is back in the news. When a breach returns to headlines, criminals commonly use it as a hook for phishing (e.g. “your account”, “compensation”, “verify details”).
Why this matters to smaller businesses
- Website disruption and reputational damage: If someone adds an admin user to your site, they can change content, add malicious redirects, steal enquiry data, and harm SEO/brand trust.
- Knock-on fraud risk: Breach-themed emails and calls can lead to password theft, mailbox compromise, and payment diversion attempts.
- SMEs often rely on third parties: If your website is managed by a freelancer/agency/MSP, you still carry the business impact when something goes wrong.
Warning signs
- New or unfamiliar WordPress admin users (especially created recently, or with generic names).
- Unexpected changes to website pages, home page, contact forms, or redirects.
- Website suddenly sending spam, or customers reporting being redirected to odd pages.
- Emails/texts/calls referencing 23andMe (or “genetic data/health data”) urging urgent action, logins, or personal details.
- Staff receiving “security check” or “refund/compensation” messages that push them to click and sign in.
How attackers may exploit the situation
- WordPress takeover: Attackers attempt to create a rogue administrator account, then log in legitimately and plant malicious plugins, add redirects, or steal form submissions.
- Impersonation and credential theft: Breach-related news is used to make phishing more believable, leading victims to fake login pages or “support” phone numbers.
- Follow-on business email compromise: Stolen credentials can be used to monitor invoices and attempt last-minute bank detail changes.
What to do today
- If you run WordPress: Review your WordPress admin user list today and remove/disable any unknown accounts. Ensure admin accounts use strong unique passwords and MFA.
- Check ownership and access: Confirm who has admin access (agency, MSP, former staff) and remove access that’s no longer needed.
- Staff reminder (2 minutes): Ask staff to treat “breach/compensation/verify your account” messages as suspicious—don’t click links; go via official websites/bookmarks and report to IT/management.
- Protect payments: Re-brief your invoice/bank-change process (call-back on known numbers; two-person approval for changes).
Ask your IT provider
- Do we run WP Maps Pro on any of our sites, and how quickly can you confirm/mitigate if we do?
- Do you monitor for unexpected WordPress admin creation or suspicious logins?
- What is our process for restoring the website quickly if it’s altered (clean backup, restore testing, and time to recover)?
- Do we have MFA enforced for WordPress admins and for our hosting control panel?
Patch watch - only one short paragraph, and only if relevant
If you use WordPress plugins, treat plugin updates as a business continuity task: ensure your website maintainer checks whether WP Maps Pro is present, updates it appropriately, and confirms no unknown admin accounts exist. Separately, a newly reported Linux privilege issue is one to track with your IT provider if you run Linux servers, but most SMEs should focus first on externally exposed services like websites and admin panels.
One action today
Review your WordPress admin users today and remove any unfamiliar accounts; then ensure MFA is enabled for all admin logins.
Related Actions On Cyber resource
Actions On Cyber checklist: Website & WordPress security quick check (admins, MFA, backups, plugin ownership)
Sources
- WP Maps Pro bug exploited to create admin accounts on WordPress sites (BleepingComputer)
- California AG sues 23andMe over 2023 breach exposing health data (BleepingComputer)
- New CIFSwitch Linux flaw gives root on multiple distributions (BleepingComputer)
This brief is for general awareness and does not replace advice from your IT provider, legal adviser, insurer or incident response specialist.