WordPress core is not the problem. Patchstack's State of WordPress Security in 2026 recorded 11,334 new vulnerabilities across the ecosystem during 2025, of which 91 percent were in plugins and 9 percent in themes, with only six in core, all low priority. The risk lives in third-party extensions running with full access to your site, which is a maintenance problem rather than a platform problem.
Where the vulnerabilities actually are
The distribution is stark and it has shifted over time. A decade ago roughly half of WordPress vulnerabilities were attributed to plugins. That share now exceeds nine in ten.
| Source | Share of 2025 disclosures |
|---|---|
| Plugins | 91% |
| Themes | 9% |
| Core | 6 issues, all low priority |
Volume is also rising steeply: 5,948 new vulnerabilities in 2023, 7,966 in 2024, and 11,334 in 2025. Weekly disclosure rates through 2026 have averaged over 250 plugin vulnerabilities, with a substantial share exploitable without any authentication.
The structural reason is simple. Plugins execute with the same database access and file system privileges as core, with no sandboxing. A flaw in a small calendar plugin gives an attacker the same reach as a flaw in WordPress itself, and the blast radius of any plugin bug is the entire site.
How sites actually get compromised
- An unpatched known vulnerability. The most common route by a distance. Exploit code frequently appears within days of disclosure and automated scanning follows immediately, so the window between publication and attack can be very short.
- Abandoned plugins. A meaningful proportion of plugins in the official repository have not been updated in over a year, many with substantial install bases. Vulnerabilities found after abandonment never get patched.
- Weak or reused credentials. Unglamorous and still effective.
- Nulled themes and plugins. Pirated commercial extensions frequently carry deliberately inserted backdoors. This is not a risk, it is the business model.
- Supply chain compromise. The development that breaks conventional advice. In 2026 a number of plugins were removed from the repository in a single day following a supply-chain attack, where the malicious code arrived through legitimate updates from trusted sources. Keeping everything updated does not help when the update is the attack.
What it costs
Rarely a single number, and rarely the largest cost is the cleanup:
- Remediation. Identifying and removing the compromise properly. Modern attacks increasingly inject code into legitimate core and plugin files rather than dropping obvious foreign files, which defeats simple scan-and-delete approaches.
- Search warnings. A site flagged as compromised loses traffic immediately and recovery is not instant.
- Email deliverability. A compromised site used to send spam can damage the sending reputation of your domain, which outlasts the cleanup.
- Downtime. Directly proportional to how much of your enquiry flow runs through the site.
- Notification obligations. If customer data was exposed, obligations may apply depending on the jurisdiction and the data involved.
What actually reduces the risk
- Run fewer plugins. The most effective single measure, and the least popular. Every plugin is attack surface. A typical installation runs twenty to thirty; most sites need considerably fewer.
- Audit for abandonment rather than only for updates. A plugin with no update in eighteen months is a liability regardless of whether it currently works.
- Update promptly, accepting that this is necessary rather than sufficient given supply-chain attacks.
- Two-factor authentication on all administrative accounts. Removes the credential route almost entirely.
- Backups held somewhere other than the server, and tested by actually restoring one.
- Never install nulled software. No exceptions worth making.
- Hosting with security at the platform level, which catches a good deal before it reaches your installation.
The honest conclusion
WordPress powers a very large share of the web and does so competently. Core is well maintained and the data supports that.
What the numbers do establish is that running WordPress is an ongoing commitment rather than a one-time build. Someone has to watch the plugins, apply updates, and hold backups, indefinitely. If nobody is doing that, the platform is not the problem, and the outcome is fairly predictable.
That is the genuine decision point discussed in single-file HTML versus WordPress: not which is better, but whether the maintenance the platform requires is going to happen.
Frequently asked questions
Is WordPress insecure?
WordPress core is well maintained. Patchstack recorded only six core vulnerabilities during 2025, all low priority, against 11,334 across the wider ecosystem of which 91 percent were in plugins. The risk sits in third-party extensions rather than in the platform itself.
Why are plugins the main WordPress security risk?
Because they execute with the same database and file system privileges as core, with no sandboxing, so a flaw in any plugin gives an attacker the same reach as a flaw in WordPress itself. With tens of thousands of plugins of varying quality and maintenance, the attack surface is very large.
Does keeping plugins updated make a site safe?
It is necessary but not sufficient. Most compromises exploit vulnerabilities that already had patches available, so updating matters greatly. However supply-chain attacks in 2026 delivered malicious code through legitimate updates from trusted sources, which conventional patching cannot prevent.
What is the most effective way to secure a WordPress site?
Running fewer plugins, which is the least popular recommendation and the most effective. Beyond that: auditing for abandoned plugins rather than only outdated ones, two-factor authentication on administrative accounts, off-server backups that have been test-restored, and never installing pirated extensions.
What does a WordPress compromise actually cost?
Remediation is often the smallest part. Larger costs include lost traffic while search warnings are displayed, damage to the sending reputation of your domain if the site was used for spam, downtime proportional to how much business runs through the site, and any notification obligations if customer data was exposed.
Are abandoned plugins a real risk?
Yes. A substantial share of plugins in the official repository have not been updated in over a year, many with large install bases. Vulnerabilities discovered after a developer stops maintaining a plugin receive no patch, so the plugin continues working while remaining permanently exposed.
West Coast Media Solutions Inc. builds and maintains websites for businesses across Canada. This article reflects patterns we see in practice. Contract and ownership questions vary by jurisdiction and agreement; where money or rights are at stake, take legal advice on your own documents.
Want a straight answer before you commit?
We will walk you through the scope, the cost, and the timeline in plain terms before you spend anything.
Start a Conversation