Is Your Nashville Small Business Website Safe? WordPress Booking and Plugin Security in Plain English

If you run a salon in East Nashville, a physical therapy clinic in Franklin, a gym in Murfreesboro, a contracting company in Hendersonville or an event venue anywhere in Middle Tennessee, there's a good chance your website takes bookings through a WordPress plugin. That plugin is open to anyone on the internet, all day, and it holds your customers' names, emails, phone numbers and appointment history.

This post is for the owner, not the developer. If you want the command-line version, I wrote the full WordPress audit checklist last week. This is the version you can read in ten minutes and act on today, even if you've never logged in to your hosting account.

It was a heavy month. A Rank Math PRO update carried a backdoor for about 11 hours on October 15 and 16. Then TeamUpdraft, the company behind UpdraftPlus, said someone got into its customer database, and stolen UpdraftCentral keys were used to install backdoor plugins on connected sites. In both cases, site owners did nothing wrong. The attack came through a vendor they trusted. On the booking side, Amelia, which runs on more than 90,000 sites, patched a critical bug that let anyone read from the database without logging in, then shipped another security release on October 27. LatePoint fixed a bug that let a stranger take over a customer's account with just their email or phone number, and researchers published details of a Bookly bug, fixed in September's 28.3 release, that exposed other customers' bookings. And on October 26, the federal Cybersecurity and Infrastructure Security Agency (CISA) added two bugs in PHP itself, the language WordPress runs on, to its list of vulnerabilities being exploited in the wild.

None of the booking plugin bugs had reported attacks when I checked. But a bug that needs no login, in a plugin on tens of thousands of small-business sites, is exactly what attackers automate. The fix in every case was an update that was already available.

Most of your WordPress site just shows pages. A booking plugin is different. It takes input from strangers, saves it in your database, sends emails and sometimes takes payments. Every one of those steps is a place where a bug can let someone in.

It's also usually the plugin nobody wants to touch. It works, the front desk depends on it, and an update that breaks the calendar on a Saturday morning is a real problem. So it falls behind. That's understandable, and it's exactly the wrong plugin to let fall behind.

You don't need to know any code for this. Ask yourself, or whoever built your site, these five questions.

1. Who updates the plugins, and when did it last happen? "The person who built it in 2022" isn't an answer. Log in to WordPress, go to Plugins, and look for anything with an update waiting. If your booking plugin is several versions behind, that's your first job.
2. Are your backups stored somewhere other than your website? A backup that lives on the same server as the site can go down with it. Ask your host or developer where the copies go, how many days they keep, and when someone last tried restoring one.
3. Who has administrator access? Go to Users and filter by Administrator. Every name should be someone you know who still needs it today. Former employees, old agencies and "admin2" accounts you don't recognize should go. An unfamiliar Editor account is worth a question too.
4. Is your booking plugin current? As of this week, that means Amelia 2.4.14 or later, LatePoint 5.7.5 or later, and Bookly 28.3 or later. If you use something else, check its changelog for anything labeled "security" in the last month.
5. Who gets the security emails? WordPress, your host and your plugin vendors send warnings to the admin email on the account. If that's a former employee's inbox or a developer who moved on, nobody's reading them. Check Settings > General in WordPress, and the contact email on your hosting account.

If you answered all five with confidence, you're ahead of most small businesses. If two or more made you shrug, keep reading.

Do it yourself when it's routine: clicking update on plugins that have a clean history, removing old admin accounts, and fixing the admin email. Update one plugin at a time and check that the booking page still works after each one. Do it on a slow afternoon, not right before your busiest day.

Call your host for anything on the server: which PHP version the site runs on, whether it's patched, where backups are stored, and how to restore one. After this month's PHP bugs, it's fair to ask your host directly whether your server has the October PHP security updates. A good host answers that in one reply.

Hire a developer when any of these are true:

• The site hasn't been updated in a year or more, and you're worried updates will break it.
• You see admin accounts, plugins or redirects you can't explain.
• Your booking plugin was customized, so updating it isn't a one-click job.
• You ran Rank Math PRO 3.0.123, connected UpdraftPlus to UpdraftCentral, or ran an old booking plugin version and want to know whether anyone got in.
• Nobody owns the site anymore, and you just need someone to take responsibility for it.

I'm a Nashville developer, and WordPress is a big part of what I do: custom plugins and themes, new builds, updates, and changes to the site you already have. A typical fix-up goes like this:

• A free intro call where you tell me what the site does and what worries you.
• A look under the hood: plugin and theme versions, admin accounts, PHP version, backups, and the signs I listed in my audit checklist.
• A written list of what I found, sorted into "fix now," "fix soon" and "fine as is," with a price for the work.
• The fixes, tested on a copy first when the site is busy enough that downtime costs you money, then a clear handoff so you know who owns updates from here.

If the site is old enough that PHP itself needs upgrading, that's work I do too. Here's what upgrading to PHP 8.5 involves.

You can read what a free quote covers, see how I work with Nashville businesses, or send me the details. You can also email caleb@calebdorris.com. I usually reply within a couple of hours.

Is WordPress safe for a small business website?

Yes, when someone keeps it updated. Most of the WordPress problems I run into come from plugins that fell behind, old admin accounts or neglected hosting, not WordPress itself. The risk is a site nobody is responsible for.

Which booking plugin versions should I be on right now?

As of late October 2026, update to at least Amelia 2.4.14, LatePoint 5.7.5 and Bookly 28.3. Newer is better. Amelia released 2.4.14 on October 27, 2026 with more security fixes.

Should I turn on automatic plugin updates?

For plugins that take input from the public, like booking, forms and checkout, I lean toward yes, as long as you have off-site backups and someone checks the booking page afterward. For heavily customized plugins, have a developer handle updates instead.

How do I know if my WordPress site has been hacked?

Common signs are admin accounts you don't recognize, plugins you didn't install, pages that redirect to strange sites, and warnings from Google or your host. A clean-looking admin screen isn't proof, because some backdoors hide from it. My audit checklist covers how to check properly.

Do you work with businesses outside Nashville?

Yes. I work with businesses across Middle Tennessee, including Franklin, Brentwood, Murfreesboro and Hendersonville, and with clients elsewhere in the US remotely.

How much does a WordPress security fix-up cost?

It depends on how many plugins the site runs, how long it's gone without updates, and whether anything looks compromised. I give a fixed quote after the intro call. Start with what a free quote covers.

• Rank Math, "Rank Math PRO 3.0.123 Security Incident: How to Secure Your Website"
• TeamUpdraft, "TeamUpdraft security incident: What customers need to know"
• Nethemba, UpdraftCentral backdoor analysis
• Patchstack, "WordPress Amelia Plugin <= 2.4.11 is vulnerable to a high priority SQL Injection"
• WordPress.org, Amelia plugin page and changelog
• WPSec, "Amelia <= 2.4.13, Unauthenticated Missing Authorization to Booking Approval" (WPSEC-2026-1849)
• Dr. Web, "LatePoint mit über 100.000 Installationen: Fremde konnten Kundenkonten übernehmen" (German)
• WordPress.org, LatePoint plugin changelog
• Sentrium Security, "Critical Bookly IDOR Leads to Booking Disclosure and Deletion (CVE-2026-93399)"
• CISA, Known Exploited Vulnerabilities Catalog
• WordPress.org, "Configuring Automatic Background Updates"