Important Vulnerability on Advanced Custom Fields Plugin for WordPress

AI agents are becoming a standard hosting workload. Tools like OpenClaw (369,000+ GitHub stars, recently acquired by OpenAI) have moved from developer experiments to production deployments. Hosting customers are installing them on VPS environments, asking for support, and expecting infrastructure that can handle them.

Stopping outbound spam keeps your server IPs off blocklists and your customers' mail moving. Inbound spam and phishing is the other half of the problem. It fills customer mailboxes, drives support tickets, and raises the chance that one of your customers hands over credentials to a phishing email.

An attacker gets in through a vulnerable plugin. They drop a backdoor file in wp-content/uploads. In the same session, they write a redirect script into wp_options and a spam link into wp_posts.post_content. A file scanner finds the backdoor. The database UPDATEs stay. The site gets cleaned and still serves pharma spam to search engines the next morning.

We’re thrilled to announce the rollout of a new version of Imunify360, engineered to deliver significant memory and performance improvements!