WordPress Security Statistics 2026: Vulnerabilities, Hacks and Patch Speed

These are the WordPress security statistics that hold up when you follow them back to the source. Every figure below links to the report or dataset it came from and states the year it describes. The short version: the number of vulnerabilities is rising fast, nearly all of them are in plugins, attacks start within hours, and in 2026 WordPress core itself was exploited for the first time in years.

How many WordPress vulnerabilities are found each year?

Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, which it says is a 42% increase over 2024. That is the most recent full-year count from a named research team, published in its State of WordPress Security in 2026 report (the page shows it was last updated on 25 February 2026).

The raw count overstates the danger, and the report says so itself. Most of those entries are low-impact bugs that need an unusual setup or a logged-in attacker. Patchstack separates out the ones that matter:

Two of those lines deserve a second read. Patchstack says the high-severity discoveries in 2025 exceeded the previous two years combined, and its chart puts the rise in highly exploitable vulnerabilities at 113% year over year. The problem is not only growing. The dangerous part of it is growing faster.

What this means for you: with roughly 4,000 serious plugin and theme flaws a year spread across the directory, every plugin you run is another chance to be on that list. The question is not whether one of yours will be affected in a given year. It is how quickly someone notices and acts when it is.

Where do WordPress vulnerabilities come from?

Almost all of them come from plugins. In Patchstack's 2025 data, 91% of new vulnerabilities were in plugins and 9% were in themes, and WordPress core accounted for just six reports, all rated low priority.

Paid software is not safer. Patchstack reports that premium and freemium components produced 1,983 valid reports, 29% of the total, and that 59% of those were high priority. Its zero-day program found 33 highly critical flaws in premium components against 12 in free ones, and it says premium components had three times more Known Exploited Vulnerabilities than free ones. A licence fee buys support. It does not buy an audit.

What this means for you: your plugin list is your attack surface. Every plugin you remove is one fewer thing to patch, and every plugin you keep should be one that is still actively updated. Our WordPress statistics hub shows how many directory plugins have gone two years or more without an update.

Is WordPress core itself safe in 2026?

Core was the quiet part of WordPress security for years, and 2026 broke that pattern. Patchstack found only six low-priority core vulnerabilities in all of 2025. In 2026, the US Cybersecurity and Infrastructure Security Agency added three WordPress core vulnerabilities to its Known Exploited Vulnerabilities catalog, which lists flaws with evidence of real attacks.

We checked the whole catalog on 23 October 2026. Before July 2026 it held no WordPress core entries at all. The three older entries filed under WordPress are all plugins: File Manager, Duplicator and Social Warfare.

The release log tells the same story. WordPress.org shipped security releases on 10 and 11 March (6.9.2 and 6.9.4), 17 July (7.0.2, one critical and one high-severity issue, pushed out as a forced update), 6 and 12 August (7.0.3 and 7.0.4), 17 September (7.1.1, with 11 security fixes), 22 September (7.1.2, one critical-severity fix) and 6 October (7.1.3, with 7 security fixes). The details are on the WordPress.org releases page, and we explain the two critical ones in WordPress core exploited in 2026.

What this means for you: "WordPress core is safe, just watch your plugins" was good advice in 2025. In 2026 it is incomplete. Automatic minor updates are what saved most sites, so confirm they are switched on and actually working.

How fast are WordPress vulnerabilities exploited?

Within hours. Patchstack reports that about half of high-impact vulnerabilities were exploited within 24 hours of disclosure in 2025, and that the weighted median time to mass exploitation for heavily exploited flaws was 5 hours.

The 2026 core flaw followed that curve exactly. The Hacker News, citing the honeypot firm Previdian, reported that the first exploitation attempt against CVE-2026-87902 was recorded on 22 September 2026 at 11:49 UTC, the same day WordPress shipped the fix. CISA added it to the exploited list three days later.

The last row matters as much as the first. Old flaws keep paying attackers because so many sites never update. Patchstack's list of the ten most targeted vulnerabilities in 2025 contained only four that were published in 2025. The top one was a LiteSpeed Cache flaw from 2024.

What this means for you: a monthly update routine is too slow for a critical flaw. It is fine for the routine releases. You need both: automatic security updates, and someone watching for the urgent ones.

What share of vulnerabilities have no fix?

46% of the vulnerabilities Patchstack recorded in 2025 had no developer fix at the moment they were made public. That is the single most uncomfortable number in WordPress security, because "keep everything updated" cannot help when there is no update.

Unfixed flaws usually belong to plugins whose authors have stopped maintaining them, or respond slowly. The only defences are to remove the plugin, replace it, or block the attack in front of the site with a firewall rule. Patchstack also tested hosting defences and found traditional host-level protection blocked only 12% of WordPress-specific exploits in its first study and 26% of attacks in a second, broader one, with wide variation between hosts.

What this means for you: "my host handles security" is mostly not true for WordPress-specific attacks. Ask your host what it blocks, and plan for the plugin layer yourself.

What do hacked WordPress sites have in common?

Outdated software and spam. The most recent public figures come from Sucuri's 2023 Hacked Website and Malware Threat Report, which covers calendar year 2023. Nothing newer of the same scope has been published, so treat these as the best available, not as current.

Read the 95.5% carefully. It is the share of infections Sucuri cleaned, and WordPress runs most of the sites that hire a cleanup service in the first place. It does not mean WordPress is 95% likely to be hacked. It means that when a CMS site is hacked, it is usually a WordPress site, which follows from WordPress running most CMS sites.

SEO spam at one remediated site in five is worth noticing, because spam is invisible to the owner and very visible to Google. Our guide to the Japanese keyword hack covers the most common family, and how to fix a hacked WordPress site covers the full cleanup.

Malware is also getting harder to remove. On 1 October 2026 The Hacker News reported Sucuri's analysis of a WordPress backdoor that stores copies of itself in at least eight places across files, the database and shared memory, and restores the full set on the next page load. Deleting the files you can see is not a cleanup.

How many WordPress sites run unsupported PHP?

34.7% of WordPress sites that report their version to WordPress.org run PHP 8.1 or older, all of which are past end of life. Another 23.5% run PHP 8.2, which loses security support on 31 December 2026. We pulled these figures from the WordPress.org PHP version statistics on 23 October 2026.

Put those together and 58.2% of reporting WordPress sites will be on a PHP version with no security support on 1 January 2027 unless they move. We cover the deadline in PHP 8.2 end of life.

What this means for you: check Tools, then Site Health, then Info, then Server. If it says 8.2 or lower, this is your most urgent job before the end of the year.

What does a breach cost?

The best-known figure is IBM's. Its 2026 Cost of a Data Breach study, run by the Ponemon Institute, put the average breach in Canada at a record CA$7.11 million, based on breaches at 602 organizations worldwide between March 2025 and February 2026, according to IBM Canada's 29 July 2026 release.

That number describes large organizations, not a ten-person firm with a WordPress site, and it would be misleading to apply it to one. No reputable source publishes an average cost of a hacked small-business WordPress site. The costs are real but different in kind: cleanup work, days of lost leads or sales, search ranking damage from spam pages, a Google "This site may be hacked" warning, and in some cases notification duties if personal data was exposed.

What this means for you: estimate your own number. Daily revenue or leads from the site, multiplied by the days it would be down or blacklisted, plus cleanup. For most businesses that sum is several times the yearly cost of maintenance, which we work through in is WordPress maintenance worth it.

Checklist: act on these numbers this week

• Confirm automatic minor (security) updates for WordPress core are on and that your site is on 7.1.3, or the patched release of your branch.
• Check your PHP version in Site Health. Plan a move to 8.3 or 8.4 if it is 8.2 or lower.
• List every plugin. Remove anything inactive. Flag anything not updated in the last 12 months.
• Check the plugins you keep against a vulnerability database, and keep the ones you rely on updated within days, not months.
• Put a WordPress-aware firewall in front of the site, because 46% of flaws had no fix at disclosure.
• Run a full off-site backup and test a restore. Our backup guide shows how.
• Search site:yourdomain.com in Google and look for pages you did not create.
• Review admin accounts and remove any you do not recognize.
• Work through the full WordPress security checklist.

How we compiled this

We used only sources we opened ourselves between 22 and 23 October 2026, and we give each figure as the source states it, with the year it refers to.

• Included: Patchstack's 2026 report (2025 data), CISA's Known Exploited Vulnerabilities catalog (checked through its 21 October 2026 update), WordPress.org release posts and statistics API, Sucuri's 2023 report, IBM's 2026 study as reported by IBM Canada, and news reports from The Hacker News and BleepingComputer that name their primary source.
• Excluded: figures repeated by blogs that do not name an origin, including widely shared claims such as a number of WordPress sites hacked per day, which we could not trace to a primary source. We also could not open Wordfence's own quarterly reports when compiling this, so Wordfence figures appear only where a named news outlet quoted them.
• Limits: WordPress.org statistics cover sites that report to WordPress.org, by branch, not by patch level. A site on an older branch may still receive security backports.

We will update this page when Patchstack publishes its next annual report or CISA adds another WordPress core entry.