WordPress security in 2026: what 11,334 new vulnerabilities mean for your site
Patchstack recorded 11,334 new WordPress vulnerabilities in 2025, and the worst were exploited within hours. Here is what the 2026 report found and the steps that actually protect your site.
Lunova
WordPress security got measurably worse in 2025. Patchstack, the WordPress security company, recorded 11,334 new WordPress vulnerabilities, a 42% increase on 2024. Almost all of them were in plugins, nearly half had no fix when they went public, and the most targeted flaws reached mass exploitation within five hours.
If your website runs on WordPress, the takeaway is simple: updating plugins is no longer a security strategy on its own. You need to know exactly what is installed, remove what you do not need, and have protection that reacts faster than attackers do.
Below are the findings from Patchstack’s State of WordPress Security in 2026 report that matter most to business owners, followed by a checklist you can work through this quarter.
Key takeaways
- Plugins are the risk. 91% of new WordPress vulnerabilities were in plugins. WordPress core had just six, all low priority.
- Attacks start within hours. Heavily exploited vulnerabilities reached mass exploitation in a weighted median of five hours.
- Updates often come too late. 46% of vulnerabilities had no developer fix when they were publicly disclosed.
- Paying for a plugin does not make it safer. Premium components had three times as many known exploited vulnerabilities as free ones.
- Your host is not a safety net. In Patchstack’s tests, traditional defences blocked only 12% of WordPress-specific attacks.
WordPress security statistics at a glance
| Finding | Figure | What it means for you |
|---|---|---|
| New WordPress vulnerabilities in 2025 | 11,334 (up 42%) | More to track than ever before |
| Share found in plugins | 91% | Your plugin list is your attack surface |
| High-severity vulnerabilities | 1,966 (up 113%) | Serious flaws more than doubled |
| No fix at public disclosure | 46% | An update may not exist when you need it |
| Median time to mass exploitation | 5 hours | Weekly maintenance is too slow |
| WordPress-specific attacks blocked by traditional defences | 12% | Generic firewalls miss most of them |
WordPress plugin vulnerabilities are where the risk lives
WordPress core is well maintained. Patchstack logged only six core vulnerabilities in 2025, all low priority. The problem is everything installed on top of it: 91% of new vulnerabilities were in plugins and 9% in themes.
Every plugin is code from a different developer, on a different release schedule, with a different attitude to security. A site running 25 plugins is trusting 25 separate teams to get it right, all of the time.
Severity is rising as well. 1,966 vulnerabilities (17%) were rated high severity, up 113% year on year, and 4,124 (36%) were serious enough for Patchstack to write a dedicated protection rule.
Attackers exploit WordPress vulnerabilities in hours, not weeks
Once a vulnerability is public, the clock starts. Patchstack found that roughly half of high-impact vulnerabilities were exploited within 24 hours, and the heavily exploited ones reached mass exploitation in a weighted median of five hours.
Mass exploitation is automated. Bots scan the web for every site running the vulnerable version and attack them all, so a small business site is as exposed as a large one. Broken access control, where a plugin fails to check whether a user is allowed to do something, was the most exploited category.
Attack volume also follows the calendar. Monarx data in the report shows malicious file uploads nearly tripled in November and December 2025, the busiest trading weeks of the year for many online shops.
Compare that with how most sites are maintained: updates applied weekly, monthly or whenever someone remembers. That gap is where sites get compromised.
Why WordPress updates alone no longer protect you
“Keep everything updated” is still the right advice, but it is no longer enough. 46% of vulnerabilities had no developer fix by the time they were publicly disclosed, so for nearly half of them there was nothing to update to.
Patchstack’s own recommendation is to stop treating plugin updates as your main defence and to put automated mitigation in place that responds to new vulnerabilities in under five hours. This is known as virtual patching: a rule that blocks the specific exploit until the developer ships a real fix.
Premium WordPress plugins are not the safe option
It is tempting to assume a paid plugin is better maintained. The data says otherwise. Premium and freemium components produced 1,983 valid vulnerability reports, 29% of the total, and 76% of the premium findings were rated high or medium priority, which makes them exploitable in practice.
Premium components also had three times as many known exploited vulnerabilities as free ones, and Patchstack’s Zero Day programme found 33 highly critical vulnerabilities in premium components against 12 in free ones.
Your hosting firewall is probably missing most attacks
Many site owners assume their host has them covered. In Patchstack’s test against known exploited vulnerabilities, traditional defences blocked only 12% of WordPress-specific attacks. In a broader test, hosts blocked 26% of attacks overall, with wide variation between providers.
Generic firewalls are built to stop generic attacks. A request that abuses one plugin’s broken permission check looks like normal traffic unless the protection knows about that plugin.
AI and new regulation raise the stakes in 2026
Patchstack expects attackers to make growing use of AI that can find and exploit vulnerabilities on its own, which shortens the window between disclosure and attack even further. 2025 already brought a sharp rise in low-quality, AI-generated vulnerability reports, which slows down the people triaging the real ones.
Regulation is moving too. Under the EU Cyber Resilience Act, manufacturers must report actively exploited vulnerabilities from 11 September 2026, and the main obligations apply from 11 December 2027. Patchstack’s reading is that every commercial WordPress plugin sold to European users will need a vulnerability disclosure programme.
Not sure how exposed your own site is? In a free website audit we go through your site with you on a live screen-share, and you leave with specific fixes rather than a vague report.
A WordPress security checklist for 2026
- List every plugin and theme you run, with its version and who maintains it. You cannot protect what you have not inventoried.
- Delete what you do not use. A deactivated plugin is still code on your server.
- Replace abandoned plugins. If a plugin has not been updated in a year, find an alternative or drop the feature.
- Add virtual patching so new vulnerabilities are blocked within hours, not whenever a fix arrives.
- Turn on automatic updates for minor and security releases, and test major ones on a staging site first.
- Lock down admin access with unique passwords, two-factor authentication and as few administrator accounts as possible.
- Keep tested, off-site backups. A backup you have never restored is a hope, not a plan.
- Monitor for malware and file changes, and clean infections surgically rather than deleting files at random.
- Publish a security contact. A security.txt file or a short vulnerability disclosure page tells researchers how to reach you before attackers find the flaw.
When rebuilding beats another WordPress patch
For some sites the honest answer is that WordPress is carrying more risk than it needs to. If your site relies on dozens of plugins for features that could be built directly, each one is a dependency you have to watch indefinitely.
A rebuild on a leaner stack removes most of that surface. Fewer third-party dependencies means fewer vulnerabilities to track, fewer emergency updates and fewer ways in. Lunova Labs designs and builds websites, e-commerce stores and SaaS platforms, and can move an existing site without giving up the search rankings it has earned.
Read how we moved a 68-page site to a new domain without losing SEO, or browse our recent work.
Ready when you are