The short answer
WordPress core is actively maintained, and its security team ships fixes, including for old versions. Most of the risk on a practice website comes from everything added around it: plugins, themes, connected services, and how quickly someone applies updates. The last few weeks have shown how fast things move once a problem is public.
That is why we build most practice websites as static Next.js sites instead of WordPress. The public website has no PHP code, no database, no login page, and no plugin installer for an attacker to reach. It is not unhackable, and we explain below what still needs care. For the comparison of speed, SEO, and editing, see our post on React vs. WordPress for medical websites. This article is about security.
What happened with UpdraftPlus in October 2026
UpdraftPlus is one of the most widely used WordPress backup plugins; Patchstack puts it at over four million active installations. Its maker, TeamUpdraft, says it identified unauthorized access to its website over the weekend of October 17 and 18, 2026, and believes its customer database was accessed. According to TeamUpdraft's incident notice, that included customer contact and billing details, order history, hashed account passwords, two-factor settings, and the connection keys for its UpdraftCentral, UpdraftVault, and UpdraftClone services. TeamUpdraft says it does not store card details, and that the UpdraftPlus plugin code and backups kept in customers' own remote storage were not affected.
The connection keys are the serious part. UpdraftCentral keys can send commands to the WordPress sites they are connected to. Patchstack reports that for about 18 hours on October 18 and 19, an attacker used stolen keys to install backdoor plugins on connected sites. The backdoor created a hidden account that looks like an Editor but can change settings and install plugins, and the account stays behind even if the plugin is removed. Patchstack's analysis lists the warning signs. As of October 22, 2026, neither company has published how many sites were affected.
Notice what this was not: it was not a flaw in WordPress, and it was not something a site owner did wrong. A trusted service with remote access to many WordPress sites was compromised, and every site connected to it was exposed.
A month earlier: a critical flaw in WordPress itself
On September 22, 2026, WordPress released version 7.1.2 to fix CVE-2026-87902, a flaw the WordPress security team rated 9.2 out of 10. Under certain server and theme conditions, it let an attacker who was not logged in make WordPress load a PHP file already on the server, which attackers could chain into running their own code. Patchstack saw the first attacks less than five hours after the patch was released, as BleepingComputer reported. Fixes were backported to older WordPress versions, but only sites that actually installed the update were protected.
WordPress applies security releases like this one automatically by default, as long as that setting has not been turned off. Plugins are a different story: many sites update them only when someone logs in and clicks the button, and five hours is not much time.
Plugins are where most vulnerabilities live
These two incidents fit a broader pattern. In its 2026 State of WordPress Security report, Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem during 2025, a 42% increase over 2024. Of those, 91% were in plugins and 9% in themes. WordPress core accounted for only six, all low priority.
Two more figures from the same report matter for a busy practice. Nearly half (46%) of the vulnerabilities had no fix available from the developer when they were made public, so updating promptly was not even an option. And for the vulnerabilities attackers targeted most heavily, the median time to mass exploitation was five hours.
Many practice sites built on WordPress carry a theme, a page builder, a form plugin, a booking or chat integration, an SEO plugin, a backup plugin, and often a few more. Each one is code running on the public server, maintained by a different company on its own schedule.
Why this matters more for a medical practice
A practice website is where patients find your phone number, request appointments, and fill in contact forms. A compromised site can quietly change where a form sends its submissions, redirect visitors to a scam page, or load scripts that collect what people type. Patients will not see the backdoor; they will see your name.
Healthcare is also a frequent target in general. HIPAA Journal's 2025 breach report counted 710 breaches of 500 or more records reported to federal regulators in 2025, with hacking and IT incidents the leading cause. Those breaches are not specific to websites or to WordPress, but they show why practice owners should treat every system that touches patient inquiries seriously.
One practical rule applies whatever your website is built on: a general contact form is not a secure channel for medical details. The forms we build tell patients not to include health information, and anything that does need to collect it belongs with a vendor that is set up and contracted for that purpose.
How we build practice websites instead
Most of our practice websites are built with React and Next.js and published as a static export. Every page is generated as a finished HTML file during the build, before anyone visits. The web server then simply delivers those files. The Next.js documentation explains that a static export cannot use features that need a running server, such as server actions, middleware, or on-demand page generation.
In practice, that removes the parts attackers most often target on a WordPress site:
No PHP and no database on the public site. No application code runs on the server when a visitor requests a page, so a flaw like CVE-2026-87902 has nothing to run on.
No admin login on the website. There is no wp-admin page to guess passwords against and no hidden account to plant.
No plugin installer. No third-party plugin service holds keys to your site. Only our deploy process can change the live files, so that process and the server accounts behind it are what we guard most closely.
Forms handled separately. Contact forms send to a separate server we run, which filters spam and emails the practice. Submissions are not stored in the website's files, and that server is secured and maintained as its own system.
Next.js is not immune, and we won't pretend it is
Next.js and React have had serious vulnerabilities of their own. In March 2025, CVE-2025-29927 let attackers bypass Next.js middleware checks. In December 2025, React disclosed a critical flaw in React Server Components. Both affected features that run on a server, and Next.js shipped fixes for more server-side flaws in August and October 2026, including remote code execution in its image optimization and caching features. Vercel's write-up of the middleware flaw notes that static exports were ruled out because middleware is not available without a server runtime, and React's advisory says apps whose React code does not use a server are not affected.
A static site still has things to protect. The code libraries used to build it need updates. The hosting, domain, and DNS accounts need strong passwords and two-factor sign-in. Form services and any third-party scripts, such as chat widgets or ad tracking, need the same scrutiny they would get on any other site. The difference is that there is much less running in public, and far fewer outside companies with the ability to change it.
If your practice website runs on WordPress: what to check this week
Check for UpdraftPlus. If it is installed, follow TeamUpdraft's instructions: update the plugin, delete the UpdraftCentral connection key, look for administrator accounts and plugins you do not recognize, and change administrator passwords. Patchstack found backdoor accounts disguised as Editors, and says the most common backdoor plugin was named "Site Health Cache" and described as "Small maintenance toolkit: keeps option storage tidy." It saw 99 different plugin names, so look for any plugin you did not install. It also notes that a checkbox on the TeamUpdraft account screen, ticked by default, could connect sites, so check even if you never knowingly used UpdraftCentral. If you have a TeamUpdraft account, change its password and reset two-factor sign-in.
Confirm WordPress is on 7.1.2 or later, or on the patched release for your version branch.
Remove plugins you no longer use, and ask who updates the rest and how often.
List everyone with admin access, including past employees, freelancers, and outside services, and require two-factor sign-in.
Check where form submissions are stored. Many form plugins keep a copy of every submission in the WordPress database.
Make sure backups are kept off the server and that someone has tested restoring one.
Questions practice owners ask
Is WordPress safe for a medical practice website?
It can be, if it is kept lean, updated promptly, and monitored by someone accountable. Most WordPress security problems come from plugins, themes, and connected services rather than WordPress itself.
Is WordPress HIPAA compliant?
No website platform is HIPAA compliant by itself. Compliance depends on how patient information is collected, stored, and handled, and who your vendors are. The safest default is to keep health details out of general website forms.
Should we leave WordPress because of this breach?
Not automatically. A well-maintained WordPress site with few plugins can be a reasonable choice. A rebuild makes sense when the site is slow, hard to maintain, relies on many plugins, or nobody is clearly responsible for updates.
Is a static Next.js site unhackable?
No website is. A static site removes the server code, database, and login page from the public website, which shrinks what an attacker can reach. Accounts, forms, and third-party scripts still need protecting.
Get a second opinion on your website
If you are not sure what your website runs on, which plugins it uses, or who keeps it updated, that is worth finding out this week. Request a free website audit and we will look at how your site is built and maintained, and tell you plainly whether it needs targeted fixes or a rebuild. You can also see how we design practice websites.
Photo credit
Stock photo of a laptop, not a Medi-Edge office or client device. Photo by cottonbro studio on Pexels, used under the Pexels license.