The subject line arrives in capital letters: URGENT: High Risk Vulnerability Has Been Detected In Your WordPress Site. The sender address ends in something that looks close enough to wordpress.org, the message cites a CVE number, and it links to a download that promises to patch the hole before anyone exploits it. In December 2023, WordPress site owners around the world received exactly that email, and the plugin it delivered patched nothing at all.
Running a website makes you a target for a particular kind of fraud. The people who send these messages know you have an admin login, a domain that has to be renewed, a hosting account that can be suspended, and a fear of losing search traffic or getting sued over an image. Every one of those anxieties has its own template.
The direct answer for a site owner staring at an alarming message: never act on a security warning, renewal invoice, takedown notice, or account alert from the link in the email itself. Log in to the service directly by typing its address, check whether the same message appears inside your dashboard, and treat any email asking you to install software, enter credentials, or pay a new vendor as hostile until the real provider confirms it.
The Fake Security Patch
The December 2023 campaign is the clearest case study of how this works. Researchers at Patchstack, a WordPress security firm, described it on December 3 as a mass-scale phishing campaign with several email variants, all warning of a vulnerability labeled CVE-2023-45124. The download installed a plugin that quietly created an administrator account named wpsecuritypatch and planted a backdoor file, which handed the attackers ongoing control of every site that ran it. Sucuri's analysts later traced the sender to an address at mail-wordpress[.]org and documented a second wave citing a different CVE number once the first one drew attention.
WordPress responded the next day with a statement on its official news blog that every site owner should memorize. The project's security team wrote that it "will never email you requesting that you install a plugin or theme on your site," and that it will never ask for an administrator username and password.
That single rule disposes of the entire category. Legitimate WordPress security fixes arrive through the update mechanism inside your dashboard or through the plugin repository, never as a zip file attached to or linked from an email. The same pattern resurfaced in 2025 when WooCommerce published an advisory about fake patch emails sent to store owners from look-alike domains, noting that its real security messages come only from official addresses at woocommerce.com or automattic.com.
Our earlier coverage of supply-chain risk in maintained plugins explains why this lure works so well. Site owners have been trained, correctly, to patch fast. The phishing email borrows that urgency and points it at a fake update.
The Renewal Invoice That Is Not From Your Registrar
The second template targets your domain name. A letter or email arrives that looks like a renewal notice, names your domain, lists a price, and warns that the name will lapse without payment. In many cases the sender is not your registrar at all. The practice is known as domain slamming, and it ranges from overpriced transfers to an unrelated company to invoices for services nobody ordered.
The Federal Trade Commission shut down one such operation in 2010. Internet Listing Service had mailed small businesses invoices designed to resemble registrar bills, charging for what it called a website address listing, and the agency put consumer injury at more than $4.2 million. ICANN, the body that coordinates domain names, has issued its own warnings about fraudulent renewal emails, and its advice is short: contact your sponsoring registrar directly with any concern about a domain's status, and be suspicious of any email offering renewal services from ICANN itself, since ICANN does not sell domains to the public.
The defense is to know three facts before any invoice arrives: who your registrar is, when each domain expires, and whether auto-renew is on. With those written down, a renewal notice from an unfamiliar company is obviously wrong. Without them, a plausible-looking bill at the right time of year can slip through the accounts payable pile of a busy small business.
The Copyright Notice That Wants Your Login
The third template plays on legal fear. A message claims an image, a paragraph, or a font on your site infringes someone's copyright and demands action under the Digital Millennium Copyright Act. Some versions link to the supposed evidence, which turns out to be malware. In a 2022 variant reported by readers to Techlicious, the link led to a form asking site owners to log in with their WordPress credentials to review the complaint, which handed those credentials to the sender.
Real DMCA notices exist and deserve a response, which is what makes the fakes effective. The distinguishing marks are practical. A genuine notice usually reaches you through your hosting provider or arrives with a specific URL, a description of the original work, and contact details you can verify independently. It will not require you to log in to anything, download a file, or click through a shortened link to see the evidence. When in doubt, ask your host whether it received the same complaint, since takedown requests aimed at hosted content often go to the host first.
The Account Suspension Alert
The fourth template imitates the platforms you depend on: a hosting company warning of suspension, a payment processor flagging your account, or a Google notice about a manual action against your site. These are the hardest to spot, because the attackers copy real layouts and sometimes find ways to send from addresses that pass standard checks. In April 2025, developer Nick Johnson documented phishing emails that appeared to come from [email protected] and passed DKIM authentication, the signature system covered in our guide to SPF, DKIM, and DMARC for contact forms.
That episode is the reason authentication alone cannot be your test. For Search Console, Google keeps every property-level message it has emailed in the message panel inside the tool, covering the past year, so the check is simple: open Search Console by typing the address and look for the same alert there. The same habit works for hosting dashboards, registrars, and payment processors, all of which surface real account warnings inside the logged-in interface.
What the Numbers Say About the Risk
The FBI's Internet Crime Complaint Center received 1,008,597 complaints in 2025 with reported losses of $20.877 billion, according to its annual report, a 26 percent increase in losses over 2024. Phishing and spoofing produced 191,561 of those complaints, while business email compromise accounted for 24,768 complaints and more than $3 billion in losses. Those are complaints filed by victims who chose to report, so the real totals run higher.
Verizon's 2025 Data Breach Investigations Report puts the small-business picture in sharper focus. Across 3,049 incidents at small and midsize organizations, social engineering made up 18 percent of breach patterns and was almost exclusively phishing, while the use of stolen credentials appeared in 33 percent of breaches. Ransomware figured in 88 percent of SMB breaches, and phishing remains one of the routes in. A single admin login harvested through a fake copyright form is enough to start that chain.
A Verification Routine That Takes Two Minutes
The most useful protection is a habit rather than a tool. When an alarming message arrives, close it and open the relevant service in a fresh browser tab by typing the address yourself or using a saved bookmark. If the warning is real, it will be waiting inside your dashboard, your registrar account, or your Search Console message panel. If it is not there, the email was not from the company it claims to represent.
Keep a short reference note with your registrar, hosting provider, domain expiry dates, and the official sending domains of each service you use. Turn on two-factor authentication or passkeys for every admin account, so a stolen password alone does not open the door. Forward suspected phishing to the impersonated company's abuse address and report losses to IC3, which builds the record that drives enforcement.
Then treat any request to install software from an email as a hard stop. WordPress has said in writing that it will never send one. The plugin attached to the next urgent message will come from someone else.
