There are more WordPress vulnerabilities today than ever, and the time between their disclosure and the first attacks is measured in hours, not weeks. According to the Patchstack report, 11,334 new vulnerabilities were found in the WordPress ecosystem in 2025, 42% more than a year earlier. The most dangerous of them were mass-exploited after about 5 hours on average. AI tools speed up both finding vulnerabilities and writing working attacks, so updating “when I get round to it, in a few weeks” is no longer enough.
Below I explain what has changed, where these numbers come from and what it means in practice for a small business website.
What do the numbers say?
The most complete data is collected every year by Patchstack, a company specialising in WordPress security. Its State of WordPress Security in 2026 report shows that:
- 11,334 new vulnerabilities were found in 2025, 42% more than in 2024,
- 91% of them were in plugins, 9% in themes, and only 6 in WordPress core itself,
- 46% of vulnerabilities had no fix available on the day they became public,
- roughly half of high-impact vulnerabilities were attacked within 24 hours, and the weighted median time to mass exploitation was 5 hours,
- typical hosting-level defences blocked only part of the attacks targeting WordPress vulnerabilities in tests.
The conclusion is simple: the weakest point of a website is not WordPress itself but its plugins. And there is less and less time to react.
What does AI change?
AI models can now read plugin code, look for bugs and write working attacks. The vulnerability known as wp2shell, disclosed in July 2026, showed this well. It affected WordPress core, and the researcher who found it did so with the help of an AI model in just over 10 hours. In his own words, no researcher could have built that exploit chain in that time without AI. Once working exploit code was published, mass attack attempts began within hours.
This works both ways. The same tools help plugin authors find and fix bugs faster. The problem is that attackers do not have to wait for the site owner to log in to the dashboard. Automated scanners check websites en masse and do not pick targets, so a small business website is as good a target for them as a large store.
There is another side too. More and more plugin and theme code is written with the help of AI, often without careful review. Such code may work, but it is not always secure.
What does this mean for a website owner?
The biggest change is the pace. A few years ago, updating once a month was enough for most websites. Today, when a vulnerability in a plugin you use becomes public, hours count.
In practice this means three things:
- Regular updates are the minimum. A site that has not been updated for a few months almost certainly has plugins with known vulnerabilities.
- With a serious vulnerability, the update cannot wait for the next scheduled round. It has to be done as soon as possible, as soon as the author releases a fix.
- You need to know what is happening on your site. Since some vulnerabilities have no fix on the day they are disclosed, it is worth having a mechanism that notices modified or added files before a change harms the site.
How to protect a WordPress site in 2026
- Update WordPress, the theme and plugins regularly, ideally on a fixed schedule rather than whenever you remember the dashboard.
- Remove plugins you do not use. An inactive plugin can have a vulnerability too, and every plugin fewer is one less thing to watch.
- Choose plugins that are actively maintained. A plugin with no update for over a year is a risk.
- Keep backups away from the website’s server, so you can return to a working version if something goes wrong.
- Enable file change monitoring and alerts about known vulnerabilities in the plugins you use.
- Secure the login: strong passwords, two-factor authentication, limited login attempts and a separate account for each person.
I describe the types of attacks themselves in the post on the most common attacks on WordPress.
On your own or with help?
If you have the time and experience, you can do most of these steps yourself. The hardest part is the speed of response: you need to follow news about vulnerabilities in the plugins you use and react the same day, not the next time you log in to the dashboard.
That is why in the Protection plan of my WordPress care and maintenance I do not wait for the next update round. When a vulnerability is found in a plugin on your site, I update it as soon as possible, and I also monitor changes to the website’s files. If malware still gets in, I remove it at no extra cost. If your site is already infected, see WordPress malware removal or get in touch.
FAQ
How many WordPress vulnerabilities were found last year?
According to the Patchstack report, 11,334 new vulnerabilities were found in the WordPress ecosystem in 2025, 42% more than in 2024. 91% of them were in plugins, and only 6 in WordPress core.
How quickly do attackers exploit new vulnerabilities?
Very quickly. Roughly half of high-impact vulnerabilities were attacked within 24 hours of disclosure, and the weighted median time to mass exploitation was 5 hours.
Does AI increase the risk of an attack on my website?
Indirectly, yes. AI helps find vulnerabilities and write working attacks faster, and automated scanners check websites en masse without picking targets. That is why the speed of updates matters, not whether a site is large and well known.
Is hosting-level protection enough?
Not always. In Patchstack’s tests, typical hosting defences blocked only part of the attacks targeting WordPress vulnerabilities. Hosting helps, but it does not replace plugin updates.
How often should I update WordPress plugins?
On a schedule at least twice a month, and when a serious vulnerability is disclosed in a plugin you use, right after the fix is released.
