Sin categoría

WordPress Security in 2026: Why Plugins Are the Real Risk

WordPress core itself is rarely the weak point. Plugins are, and attackers can move within hours of a flaw becoming known. The practical answer is fewer plugins, automatic updates where they are safe, tested backups, stronger logins and a clear owner for maintenance, instead of assuming that your host has it covered.

How big is the problem?

The most detailed public data comes from Patchstack’s State of WordPress Security in 2026. Patchstack sells WordPress security products, so read its report with that in mind, but it does publish its methods.

  • 11,334 new vulnerabilities were reported in the WordPress ecosystem in 2025, 42% more than in 2024.
  • 91% were in plugins and 9% were in themes.
  • Only 6 were in WordPress core, all rated low priority.
  • 46% had no developer fix at the time of public disclosure.

More reported vulnerabilities does not automatically mean more hacked sites. Better research and more bug hunting can raise the count too. Still, the breakdown is the useful part: your risk is shaped far more by what you install than by WordPress itself.

How fast do attackers move?

Faster than a monthly maintenance visit. Patchstack reports that about half of high-impact vulnerabilities were exploited within 24 hours, and a weighted median of 5 hours to mass exploitation among heavily exploited flaws. These timings are measured from when its own mitigation rule was deployed to the first exploit attempt seen, so they describe its dataset rather than every site on the web.

Our takeaway is that “we update plugins once a month” is no longer a complete security plan for any site that matters to your business.

Doesn’t my hosting company protect me?

Partly, and you should ask how. In Patchstack’s penetration tests, hosts’ defenses blocked 12% of WordPress-specific exploit attacks in the first test and 26% of total attacks in a second, broader test. Again, this is one vendor testing a market it competes in. It is enough to justify a direct question to your host: what do you block at the WordPress application level, and what remains my responsibility?

What does WordPress itself recommend?

WordPress’s hardening guide, updated in October 2026, covers the main points:

  • Keep WordPress on the latest version, since older versions no longer receive security fixes.
  • Keep plugins updated and delete the ones you do not use.
  • Install plugins only from the WordPress.org repository or well-known companies.
  • Enable two-step authentication.
  • Back up regularly, including the database, and keep periodic snapshots from before any possible compromise.

Note the point about snapshots. If an attack goes unnoticed for weeks, last night’s backup may contain the same infection.

Should you turn on automatic updates?

For most small business sites, we think yes for most plugins, with a backup in place. Since version 5.5, WordPress lets administrators opt in to automatic updates plugin by plugin and theme by theme. By default, these updates run twice a day and notify the owner by email, which is a much better match for the timing above than a monthly visit. WordPress also suggests making sure you can roll back before enabling them.

There are two limits. Updates sometimes break things, so we would handle business-critical plugins, such as checkout or booking tools, with more care and use a staging copy when possible. And updating cannot help when no patch exists, which is the case for the 46% above at disclosure. That is why reducing your plugin count and having a firewall are worth considering.

What should a realistic maintenance routine include?

This is our recommended routine for a typical small business site. Adjust it to your risk.

Every day (automated)

  • Automatic updates running, with email alerts going to someone who reads them
  • Automated backups stored away from the web server
  • Uptime and malware monitoring

Every month

  • Review the plugin list. Delete anything unused, and question anything with a free alternative already built in.
  • Check for abandoned plugins, including those that no longer receive updates.
  • Remove old user accounts and confirm that administrators use two-step authentication.
  • Check that your forms still send leads after updates.

Every quarter

  • Restore a backup to a test site. A backup you have never restored is an assumption.
  • Review who has access to hosting, the domain and WordPress.
  • Recheck page speed, since plugins can affect that as well.

Before you buy any plugin

Ask four simple questions. Do we really need it? Who maintains it? When was it last updated? Could a few lines of code or an existing feature do the same job? Fewer moving parts means less to patch.

Is WordPress still a safe choice?

We think so, when it is maintained. It remains the most common CMS by far, running 58.2% of sites with a known CMS according to W3Techs. That popularity makes it an attractive target, in our view. But with only six reported core vulnerabilities in 2025, the platform is not the usual problem. Unmanaged add-ons are.

Choosing a hosted platform removes part of this work, and for very simple sites that can be the right call. But it does not make every security question disappear, and you give up some control in exchange.

Frequently asked questions

How do I know if my WordPress site has been hacked?

Warning signs include unknown admin accounts, strange redirects, spam pages in Google results, security warnings in browsers or Search Console and unexpected changes to files. If you see any of these, get help before deleting things, so the cause can be found rather than only the symptom.

Is a free security plugin enough?

It can be a useful layer, but it adds another plugin to maintain, and it will not replace updates, backups or strong logins. Judge it by what it actually blocks.

Are premium plugins safer than free ones?

Price alone does not tell you. Look at the developer’s update history, how it handles security reports and how recently it has released a fix. WordPress advises sticking to its repository or well-known companies.

Who should be responsible for security?

One named person or provider, in writing. Many problems start when the owner believes the host is covering it, the host believes the developer is and the developer finished the project years ago.

Not sure who is looking after your site?

JONTI Code Design designs and builds WordPress sites from San José, Costa Rica, and works in English and Spanish in GMT-6. If you would like help reviewing your plugins, backups and access, email us at info@jonti.co.cr.

Sources