Businesses across the City of Moreton Bay are being urged to check their websites after cybercriminals began exploiting a critical vulnerability in WordPress that could allow attackers to take control of unpatched websites.
The vulnerability, identified as CVE-2026-63030, was patched by WordPress on 17 July. However, cybersecurity researchers confirmed attackers quickly began targeting websites that had not installed the security update, highlighting the importance of ongoing website maintenance.
Web-Sta Web Design founder Karen Ahl said many small businesses underestimate the importance of keeping their websites up to date, often assuming their hosting provider or developer is automatically managing security.
“The most common reason websites become compromised is not keeping WordPress, themes and plugins updated regularly,” Karen told Moreton Daily Business.
She said businesses should also avoid using weak passwords or default usernames such as “admin”, as these make it significantly easier for attackers to gain unauthorised access.
While many attacks happen behind the scenes, Karen said there were several warning signs business owners should watch for, including unexpected changes to website content or layout, websites loading slowly or going offline without explanation, an increase in spam emails from online forms, or Google flagging a website as unsafe.
For businesses with administrator access, unfamiliar plugins or administrator accounts could also indicate a compromised website.
“If you suspect your website has been affected, don’t panic,” Karen said.
“Back up your website before making any changes, contact your web host or web developer immediately, change your passwords and run a malware scan. Trying to fix it yourself without the right knowledge can sometimes make the situation worse.”
Karen said cybersecurity should be viewed as an ongoing business investment rather than a one-off task.
“New vulnerabilities are discovered all the time. Staying up to date is your first line of defence. Regular monitoring helps catch issues early before they impact your business or your customers.”
Karen’s top tips to protect your business website
- Keep your website updated: Install WordPress, theme and plugin updates as soon as they become available.
- Strengthen your login security: Use strong, unique passwords, avoid default usernames such as “admin” and enable two-factor authentication where possible.
- Remove unnecessary plugins: Delete unused plugins and themes to reduce potential security vulnerabilities.
- Back up your website regularly: Schedule automatic backups and make sure they can be restored if needed.
- Monitor your website: Use security monitoring tools and choose a hosting provider with strong security practices to detect threats early.
With WordPress powering millions of business websites worldwide, the latest security incident serves as a timely reminder that a company website is a critical business asset. For many businesses, regular maintenance and security updates are no longer optional, but an essential part of protecting operations, customers and reputation.
Access local business stories, industry insights, events and opportunities designed to help you connect, collaborate and grow. Join 4,000+ businesses across Moreton Bay and beyond, receiving regular updates direct to their inbox.Join Moreton Bay's growing business community
