WordPress: the risk often comes from the ecosystem
WordPress powers a considerable share of the world's websites, which makes it a frequent target. The WordPress core is actively maintained, but a real-world site also depends on its plugins, its themes, its hosting, its administrator accounts and its update discipline. That is often where incidents begin.
What the 2025-2026 figures reveal
Patchstack's annual report, "State of WordPress Security in 2026", published on 25 February 2026 and covering 2025, gives a precise measure of where the risk really comes from, and it largely confirms the point above:
New vulnerabilities discovered in 2025: 11,334 (up 42% in a year).
Share of vulnerabilities found in plugins: 91% (9% in themes).
High-severity vulnerabilities, exposed to automated mass attacks: 1,966, or 17%.
Change in highly exploitable vulnerabilities over one year: up 113%.
Weighted median time before first exploitation, for the most heavily exploited flaws: 5 hours.
Vulnerabilities with no patch available at the time of public disclosure: 46%.
Professional clean-up of a compromised site: from a few hundred to a few thousand dollars.
The most telling figure is the time to exploitation: for the most actively exploited flaws, a median of 5 hours between disclosure and first exploitation. Waiting until "next week" to apply a security patch is no longer a viable option in this ecosystem.
So-called supply chain attacks add a particularly worrying dimension to this picture. When a popular plugin is compromised at the source, for example through its publisher's hacked account, every site using it is exposed at once, including those whose administrators have not been negligent in any way. This type of incident, already seen in the official plugin directory, is a reminder that no individual vigilance removes the need to monitor what you install and to react quickly as soon as an alert is published.
The main risks to watch
Abandoned plugins: an extension that has not been updated for a long time can become incompatible, vulnerable or simply unmaintained as new WordPress versions arrive. With 91% of vulnerabilities located in plugins, this is the number one point of attention.
SQL injection and XSS: a poorly secured plugin can expose the database, inject code into a page or compromise visitor sessions.
Privilege escalation: an authorisation flaw can allow a limited account, or even a visitor, to obtain higher rights. This is all the more critical as highly exploitable vulnerabilities more than doubled in 2025 (up 113% in a year).
Overly heavy themes and page builders: an old theme, a poorly maintained builder or an accumulation of extensions can multiply the attack surface.
Unusable backups: an unchecked backup is no guarantee. Many sites discover too late that their archives are incomplete, corrupted or stored in the same place as the compromised site. A sign of how serious this is: according to Sucuri's latest report (2023 data), nearly half of compromised sites (49%) contained at least one backdoor left by the attacker, which persists even after a superficial clean-up.
The priority checks
Update the WordPress core, plugins and themes as soon as a security patch is released, ideally within hours given the median time to exploitation of 5 hours. Follow the official WordPress.org announcements and the release notes of critical extension publishers.
Remove what is not used: a deactivated plugin that is still installed remains code on the server. Uninstall unnecessary extensions and replace abandoned plugins.
Limit administrator accounts: two-factor authentication, strong passwords, removal of dormant accounts, minimum necessary rights.
Back up off the server: keep recent backups, encrypted if necessary, stored away from the main hosting, then test a full restore.
Monitor files and logins: logging, login alerts, detection of modified files, blocking of repeated attempts, and in particular a search for backdoors after any suspicious incident.
Add application-level protection: a WAF or a WordPress security service can filter known attacks, but it does not replace maintenance.
Choosing a plugin carefully before installing it
Since plugins concentrate most of the risk, the first security reflex comes into play before installation, at the moment of choosing. Not all extensions are equal, and a few simple indicators help sort them. The date of the last update shows whether the publisher still maintains the product: an extension that has been silent for a year or two is a warning sign. The number of active installations and the reviews give an idea of its proven reliability in the field. The publisher's responsiveness to past vulnerabilities, often visible in the version history, says a lot about what will happen at the next alert.
A good plugin is also one you actually need. Every extension installed widens the attack surface, whatever its quality, and adds a dependency to monitor over time. Before installing, the real question is therefore not only "is this plugin safe?" but "do I really need this feature?". Restraint is a security strategy in its own right here.
A simple method for auditing your site
Start by drawing up an inventory: WordPress version, active theme, unused themes, active plugins, deactivated plugins, date of last update and the actual role of each extension. Then sort the plugins into three categories: essential, replaceable, unnecessary. Unnecessary plugins should be removed; replaceable ones should be compared with actively maintained alternatives (update frequency, publisher responsiveness to vulnerabilities); essential ones should be closely monitored.
Check access too: administrator accounts, contractor accounts, API keys, FTP/SFTP access, the database, the hosting control panel. A compromised WordPress site is not always compromised through a plugin flaw: it can also be through an old account, a reused password or a forgotten contractor login.
React quickly, but above all anticipate
You still have to detect the compromise, because it is often silent. A site can be hacked without anything obvious showing: the signs lie in the details, such as recently modified files you did not touch, an unknown administrator account, unexplained slowdowns, strange redirects or an alert from the host. Nearly one compromised site in two contains a backdoor that the attacker leaves behind in order to come back, and which easily goes unnoticed without a dedicated check.
If a compromise is confirmed, isolate the site, restore a clean backup, change all passwords and identify the entry point before putting the site back online. Always check that no backdoor remains. But the best incident is the one that never happens: proactive maintenance, with scheduled updates and tested restores, costs far less than an emergency clean-up, billed at anything from a few hundred to several thousand dollars, not counting the sales lost while the site is down.
WordPress security is a discipline, not a product
No security plugin, however good, replaces regular hygiene: updates applied quickly, a controlled set of extensions, tested backups and monitored access. It is modest but continuous work, without which the best protection ends up bypassed through a flaw left open too long. The good news is that most compromises exploit flaws that are already known and patched: avoiding them is more a matter of consistency than of expertise.
These reflexes extend those described in our e-commerce maintenance checklist. Our website audit identifies the technical, mobile, SEO and security priorities before the necessary fixes are made.
Sources: Patchstack, State of WordPress Security in 2026 · Sucuri, 2023 Hacked Website & Malware Threat Report · Hide My WP Ghost, WordPress security statistics 2025-2026 · WordPress.org, releases