I received a "WordPress vulnerabilities detected" email. What should I do?

Why did I receive this email?

At Hodi we run monitoring tools to improve the security of the sites we host.

One of them, WP Toolkit, scans your WordPress installation every day and compares the versions of WordPress, your themes and your plugins against the public vulnerability databases.

When a known vulnerability is found, a notification is sent to you automatically. It lists the affected sites and, for each one, the components that need updating.

This notification is informational: it does not mean your site has been compromised, only that an update is recommended to keep your security level where it should be.

Has my site been hacked?

No.

This notification does not mean your site has been compromised. It means one or more installed components have a known, published security vulnerability, meaning it is publicly documented and therefore also known to attackers.

That is exactly the point of this email: to let you act before an incident happens.

How do I read this email?

Each affected site is listed with the components that need updating. For every component you will see:

A component appears on a single line even when it carries several flaws: the action is the same either way, one update.

Where should I start?

Work through them in this order:

1. Components marked ⚠ Actively exploited. Automated attacks are already targeting this flaw. Handle these the same day.
2. Components marked Critical (score 9.0 and above). Handle within 24 to 48 hours.
3. Components marked High (score 7.0 and above). Plan these within the week.
4. Medium and Low. Fold these into your normal maintenance.

One important point: the score alone does not set the priority. A Medium flaw that is actively exploited is more urgent than a Critical one nobody is exploiting. The "Actively exploited" label always outranks the score.

What should I do?

In most cases it is enough to update the affected component (WordPress, theme or plugin) to its latest version.

We also recommend deleting any themes and plugins you no longer use, to reduce your site's attack surface.

How do I update with WP Toolkit?

1. Log in to your cPanel.
2. Open WordPress Management (WP Toolkit).
3. Click the site concerned.
4. Click the Updates link at the bottom left.
5. If updates are available, you can apply them in a few clicks.
6. Once the update is done, check that your site still works normally.

If the site is live, take a backup before updating.

No update is available. What should I do?

Sometimes a flaw is published before the author has released a fix. The email then shows "no update available".

In that case:

1. Contact the plugin or theme author and ask when a fix is planned. Quote the CVE reference from the email: it lets them identify the exact flaw. For a plugin published on WordPress.org, its page has a Support tab; for a commercial plugin, use the vendor's support channel.
2. Check the component's official page (changelog, announcements, roadmap): a fix is sometimes already announced or in progress.
3. Meanwhile, decide whether the component is essential. If it is not, deactivate it and delete it: a deactivated but still installed plugin can, in some cases, remain reachable.
4. If the component is no longer maintained (no update for a long time, author unreachable), plan to replace it with a maintained alternative. That is the only lasting fix.

If you are unsure how to proceed, ask the developer or agency who looks after your site.

Is it urgent?

We recommend applying updates as soon as possible.

Some vulnerabilities carry limited risk, while others are exploited very quickly after disclosure, sometimes within hours. The Actively exploited and Critical labels identify exactly the ones that cannot wait.

Can I ignore this email?

We advise against it.

Even if your site works perfectly, a known vulnerability can be exploited by bots that constantly crawl the internet looking for sites that have not been updated. These bots are not targeting your site specifically: they automatically test every address they come across.

Why am I receiving this email again?

You receive an email whenever new vulnerabilities are detected on your sites.

In addition, as long as a component with a Critical or Actively exploited flaw has not been updated, you will get a weekly reminder. It is marked Reminder and repeats the alerts concerned so they do not get lost.

Alerts labelled Already reported were in an earlier email; the ones without that label are new.

I applied the update but received another email. Is that normal?

The scan runs once a day. If you have just updated, the alert will clear on the next scan.

If the component keeps appearing after that, check the update really was applied: in WP Toolkit, the installed version should match the fixed version shown in the email. A staging site or a copy of your site may also be affected, so check the exact address of each site listed in the email.

Can I automate updates?

Yes.

In WordPress Management in cPanel, select your site and open Auto-update settings.

There you can enable automatic updates for WordPress, themes and/or plugins, which reduces your exposure to known vulnerabilities.

We still recommend checking your site regularly, especially if you use custom-built themes or plugins.

Does Hodi update my WordPress site?

Hodi maintains and secures the hosting infrastructure (servers, operating system and services).

Updating WordPress, themes and plugins is part of maintaining your site and remains your responsibility.

I need help. Who should I contact?

If you have questions about an update, if you are unsure whether it is compatible with your site, or if it causes a malfunction, we recommend contacting:

• the developer or agency who built your site;
• the developer of the plugin or theme concerned, if the problem is specific to it.

They are best placed to advise you and maintain your site.

Updated on: 12/08/2026