The Exit Log
Leaving WordPress,
in writing.
Notes on the work.
security
PHP2Shell (CVE-2026-109618): the critical flaw under every WordPress site, and who has to patch it
Two critical flaws in PHP itself, rated CVSS 9.2, let one unauthenticated request take over a server before WordPress even loads. No plugin or WordPress update fixes them. Which PHP versions are fixed, how to check yours, what your host is doing, and what to do if you are on PHP 8.1 or older.
security
UpdraftPlus backdoor: when your backup plugin installs the attacker's plugin
An attacker broke into TeamUpdraft over the weekend of October 17 and used stolen UpdraftCentral keys to install backdoor plugins on WordPress sites, skipping the login form and 2FA. Who is exposed, what to check today, and why the same week also brought a poisoned Rank Math PRO update and PHP2Shell.
security
CVE-2026-94504: the Ninja Forms flaw where the attacker fills in your contact form
Ninja Forms (500,000+ sites) has an unauthenticated stored XSS that is being exploited since October 5. The attacker submits your form, you open the submission, and a script installs a fake plugin, two admin accounts, a secret login URL and a file manager. Here is what to check.
security
CVE-2026-87902: the WordPress core flaw exploited the day it was patched
A 9.2 critical in WordPress core itself, not a plugin. Every version since 4.7 (2016) is affected, and attacks started hours after the September 22 fix. Here's what to check and who is actually exposed.
compare
WooCommerce vs Shopify: what you actually trade.
WooCommerce vs Shopify, compared honestly: fees, security, checkout, migration and lock-in - and when staying on WooCommerce is the better call.
migration
WordPress alternatives in 2026: an honest guide by site type
There is no single replacement for WordPress. What you should move to depends on whether your site is a showcase, a publishing operation, or a store — with the honest recommendation for each, and the cases where staying put is the right call.
compare
WordPress vs Astro: what you stop running.
WordPress runs your site as an application; Astro compiles it into pages a CDN serves. What that changes for editing, security, speed and cost - and when WordPress is still the right call.
compare
WordPress vs Next.js + Sanity: what you rent, what you own.
WordPress keeps the editor and the website in one application you patch. Next.js + Sanity splits them and moves the editing half into a hosted service you rent per seat. What that actually trades, row by row.
compare
WordPress vs Next.js + Payload: what actually changes.
WordPress vs Next.js + Payload CMS, compared honestly: editing, security, speed, cost and lock-in - and when staying on WordPress is the better call.
migration
Should I keep patching WordPress, or leave? A decision guide with the math
Staying on WordPress means paying to keep a problem manageable - hosting, security plugin, care plan - forever. Leaving means paying once. Here's how to work out which is right for your site, with the numbers and the honest cases for both.
security
This month in WordPress vulnerabilities: August 2026
August 2026's WordPress security roundup: Everest Forms (100,000+ sites, unauthenticated file upload) and User Profile Builder (40,000 sites, admin takeover) — what to check on your site right now.
data
Is WordPress safe in 2026? What 11,334 new vulnerabilities tell us
WordPress core is reasonably secure, but 91% of the 11,334 vulnerabilities disclosed in 2025 came from plugins. Here's where the risk actually lives, how fast it's exploited, and who should worry.
Free audit · 20-minute call · No obligation
Make this the last patch
you ever install.
Drop your URL. You'll see your plugin count, known-vulnerable plugins and what the stack costs you a month - then pick a time to go through it together. You leave with a plan either way: a fixed quote, or honest advice to stay put.