Published on 2 August 2026
Anyone who installed an update for the WordPress plugins Fluent Forms Pro or Ninja Tables Pro on 31 July 2026 between 4:00 pm and 9:00 pm German time – possibly even automatically, without realising it – may have brought a backdoor onto their own website. Not through a bug, not through a weak password, but via the vendor's official update server. That is precisely what makes this incident so insidious: those affected are the very website operators who did everything right and kept their plugins exemplarily up to date.
In this article, we explain exactly what happened, whether your website could be affected, how to check, and what you need to do right now – including the important GDPR question of whether you have to report the incident to an authority.
On 31 July 2026, the update infrastructure of the vendor WPManageNinja was abused to deliver manipulated versions of two widely used plugins. Specifically, these are:
The critical window lasted around five hours – from 14:00 to 19:00 UTC, which corresponds to 4:00 pm to 9:00 pm German summer time. Anyone who updated one of these plugins during this period downloaded a version laced with malicious code. This also affected everyone who had enabled automatic updates – a circumstance that makes the matter particularly treacherous, since auto-updates are actually considered a security best practice.
According to WPManageNinja, 1,368 customers were notified as a precaution. Of these, around 295 customer accounts demonstrably did download the manipulated version. WPManageNinja responded the same day: the server was shut down, the attacker's access removed and clean versions published.
This incident is a classic supply-chain attack – an attack in which your website is not targeted directly, but rather the supply chain behind it: in this case, the vendor's update server. The malicious code was therefore not embedded in a security vulnerability of the plugin itself, but was smuggled in via the trusted distribution channel.
How could this happen? WPManageNinja had in the past switched its payment and delivery system from the software "Easy Digital Downloads" (EDD) to its own system. During this migration, an old update server accidentally remained online – including what are known as proxy routing rules, which forward requests. Attackers broke into this forgotten server. When a website then requested an update, the proxy partly forwarded the request to the compromised server, which delivered the manipulated version.
The injected malicious code – hidden, for example, in files with the inconspicuous names class-license-sync.php (in Fluent Forms Pro) or NinjaTableDataSync.php (in Ninja Tables Pro) – did several things:
A security researcher summed up the significance succinctly in an analysis on Reddit:
"Every site has its own token and its own login_key. The login_key is a login into wp-admin without a password. So this isn't just one site phoning home. Someone had a working admin door on every infected site – for as long as the database entry sat there." (Security Researcher, Reddit)
You are potentially affected if all of the following points apply:
Since automatic updates often run unnoticed in the background, you should not rely on the assumption that you "didn't do an update at all". When in doubt, check actively – the following steps show how.
Work through the following four checks. If you feel technically unsure, bring in a service provider – but don't wait to do so.
Regardless of whether you have already found signs of an infection: if your website was updated within the critical window, you should play it safe and clean up. The order matters – a simple update is not enough, because the malware restores itself.
The vendor itself openly admitted the mistake. Founder Shahjahan Jewel wrote in the official incident report:
"This was our fault. That old server should have been switched off when we finished migrating away from EDD... We let you down here, and I am sorry."
For German SMEs, this is perhaps the most important question – and it has legal consequences. Since the malware set up a full, passwordless admin access, attackers potentially had access to all the data of the affected website: customer data, form submissions (highly relevant precisely for a form plugin like Fluent Forms) and user data.
This means that, in the case of a confirmed infection, there is as a rule a breach of the protection of personal data within the meaning of the GDPR. Under Art. 33 GDPR, controllers must report such a data breach to the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it – unless the breach is unlikely to result in a risk to the rights and freedoms of the affected individuals.
Given a potential full access to personal data, a high risk must be assumed. In practice, this means: if you determine an infection, you must as a rule report the incident. In addition, under Art. 34 GDPR, there may be an obligation to inform the affected individuals themselves. A failure to meet the reporting obligation can result in substantial fines. Therefore, carefully document your checks and your cleanup steps – this is also important for your own record-keeping.
Supply-chain attacks are particularly insidious because they bypass the classic protective measures. A strong password, a Web Application Firewall (a protective filter in front of the website) or two-factor authentication are of little use when the threat comes into the house via the trusted update channel. As in this case, those hit are precisely the security-conscious operators who conscientiously keep their software up to date.
The figures show that this is not an isolated case: according to the Verizon Data Breach Investigations Report, in 2025 30 percent of all security incidents were connected to third parties – i.e. to the supply chain. And in the WordPress ecosystem alone, according to Patchstack, 11,334 new vulnerabilities were discovered in 2025. The plugin ecosystem is WordPress's greatest strength – and at the same time its largest attack surface.
The WPManageNinja incident shows that "always install updates immediately" remains correct – but on its own is no longer enough. If you use Fluent Forms Pro or Ninja Tables Pro and your website received an update on 31 July 2026 between 4:00 pm and 9:00 pm German time, check now actively using the steps outlined above. If you find signs of an infection, a simple re-update is not enough: you must reinstall the plugin cleanly, clean up the database and the malicious cron jobs, rotate the salts and reset all admin passwords.
And don't forget the legal side: in the case of a confirmed infection, the incident is as a rule reportable for German SMEs – and the 72-hour deadline runs from the moment you become aware of it. Act therefore swiftly, thoroughly and in a documented manner. Those who clean up properly and report correctly minimise both the technical and the legal risk.