Quick answer: WordPress core is reasonably secure — it had just 6 disclosed vulnerabilities in 2025. The ecosystem around it is the problem: roughly 91% of the year's 11,334 disclosed vulnerabilities were in plugins and themes, and roughly half of the high-impact flaws were being exploited within 24 hours of going public. Your risk is a function of how many plugins you run.
The 2025–2026 numbers, in context
Security researchers disclosed 11,334 vulnerabilities across the WordPress ecosystem in 2025 — a 42% increase over the previous year. For perspective, that's an average of 31 new disclosures every day, per Patchstack's State of WordPress Security in 2026.
Growth like that isn't only a sign that researchers got better at looking (though they did) — it tracks the ecosystem's structural problem: an enormous surface of third-party code, maintained on volunteer schedules, running with full privileges inside millions of sites.
Why plugins are the weak point
Here's the distribution that matters. Of those 11,334 vulnerabilities, only 6 were in WordPress core. About 10,300 were in plugins and roughly 1,000 in themes — 91% of the total came from plugins alone.
This is why "keep WordPress updated" is necessary but nowhere near sufficient advice. A typical business site runs 20–30 plugins. Each one is a separate codebase, a separate maintainer, and a separate patching schedule — and each runs with enough privilege to compromise the whole site. Your effective security is the security of your least-maintained plugin.
| Where 2025's vulnerabilities lived | Share |
|---|---|
| Plugins | ~91% |
| Themes | ~9% |
| WordPress core | 6 vulnerabilities total |
Two more figures complete the picture: about a third of vulnerabilities (33%) had no patch available at the moment they were disclosed, and 43% are exploitable without any login — an attacker needs nothing but your URL.
How fast disclosure becomes attack
The uncomfortable part isn't the volume — it's the speed. Once a vulnerability is public, automated scanners begin sweeping the web for sites running the affected plugin. Patchstack's data for 2025 shows that roughly half of high-impact vulnerabilities were exploited within 24 hours of disclosure.
That timeline is the real reason patch discipline fails ordinary site owners. Patching weekly — which is more than most busy businesses manage — still leaves a multi-day window on most new flaws. You are effectively in a race against botnets, every week, forever.
Can security plugins keep up?
Partially — and it's important to be fair here. A well-configured security plugin raises the bar meaningfully: it blocks known attack signatures, limits login abuse, and alerts you to file changes. If you're staying on WordPress, you should absolutely run one.
But the math is against perimeter defenses. Most modern exploits arrive through legitimate-looking requests to vulnerable plugin endpoints — traffic a generic firewall has no reason to distrust until a signature for that specific flaw exists. And signatures, by definition, arrive after the attack is known. With a third of flaws unpatched on the day they're disclosed and half of the serious ones exploited within 24 hours, "after" is often too late. (Virtual-patching services like Patchstack narrow this window considerably — for a monthly fee, forever. Whether that fee is the right answer is the question the rest of this site is about.)
Who should worry — and who shouldn't
An honest risk assessment, since blanket fear helps nobody:
- Lower risk: a brochure site with 3–5 plugins, all from major vendors, on managed WordPress hosting with automatic updates. Keep it patched and monitored, and staying put is defensible.
- Meaningful risk: 15+ plugins, any abandoned or niche plugins, WooCommerce with customer data, or a site your business depends on daily. You're carrying real exposure, and it compounds as plugins age.
- High risk: you've been hacked before, you're running plugins that no longer receive updates, or nobody owns patching at your company. Reinfection and repeat incidents are the norm here, not the exception — because cleanup doesn't shrink the attack surface that caused the breach.
The structural alternative is removing the attack surface instead of defending it: modern platforms have no plugin layer and no exposed admin database, which is why this entire class of vulnerability simply doesn't apply to them. That's a bigger decision than installing a plugin — we've written an honest comparison in Malware clean-up vs. migration: the real cost over 3 years if you're weighing it.
FAQ
Is WordPress itself insecure? No — WordPress core is actively maintained and had only 6 disclosed vulnerabilities in 2025. The risk concentrates in the plugin ecosystem, which produced roughly 91% of the year's 11,334 disclosed vulnerabilities.
How quickly are WordPress vulnerabilities exploited? Fast. Patchstack's 2025 data shows roughly half of high-impact vulnerabilities being exploited within 24 hours of public disclosure, and 43% of all disclosed flaws need no login to exploit.
Do security plugins and firewalls solve this? They help but don't close the gap: a third of vulnerabilities (33%) had no patch available on the day they were disclosed — meaning no fix exists to install when attacks begin — and generic firewalls only block what they already have a signature for.
Source: Patchstack — State of WordPress Security in 2026 — all 2025 figures above (11,334 disclosures, +42%, 91% plugins / 9% themes / 6 core, ~50% of high-impact flaws exploited within 24h, 43% unauthenticated, 33% unpatched at disclosure) are from that report. Updated September 2026.