WordPress updates: the holes are in plugins, not the core

I build websites on WordPress myself and I still think it's a good choice for many businesses. But when a client asks me whether WordPress is secure, I answer: the core is, the problem is plugins and missing updates. Below are the numbers from 2025 and 2026 and a simple list of what to check on your own site.

Every plugin is someone else's code running on your website. Photo: Justin Morgan / Unsplash.

Why this affects almost every business

According to W3Techs, WordPress runs 39.3% of all websites and 58.1% of sites whose CMS can be identified. If you have a business website, there's a good chance it's built on it. That means bots attacking WordPress will find you too, no matter how small your business is.

What the vulnerability data says

Patchstack publishes the most detailed numbers. Its State of WordPress Security in 2026 report covers all of 2025:

• 11,334 new vulnerabilities were found in the WordPress ecosystem, 42% more than in 2024,
• 91% of them were in plugins, 9% in themes, and only 6 in the core itself, all low priority,
• 46% of vulnerabilities had no fix on the day they were publicly disclosed,
• for the most heavily exploited vulnerabilities, the median time to the first attack was 5 hours,
• premium plugins and themes had 3 times more exploited vulnerabilities than free ones.

Those 5 hours impress me the most. If you update your site "every now and then", you're simply too late for a dangerous vulnerability. A paid plugin doesn't buy peace of mind either, the numbers suggest the opposite.

Patchstack also tested how much typical hosting protection blocks. For attacks on known WordPress vulnerabilities it was 12%, in a broader test 26%. To be fair, Patchstack sells its own protection, so it has an interest in these results. Still, the takeaway is simple: don't assume your hosting will handle it for you.

Old versions are an open door

The official WordPress.org statistics show that about 34% of sites don't run the current major WordPress version (7.1). PHP is even worse: about 32% of sites use a version older than 8.2, and 14.4% are still on PHP 7.4.

Meanwhile, according to php.net, only versions 8.2 to 8.5 are supported today. PHP 8.2 only gets security fixes, and only until 31 December 2026. Anything older gets no patches at all.

An old, unpatched site is a perfect target. I recently wrote about how criminals put a fake Cloudflare verification on hacked sites to infect visitors' computers. The owner often finds out from customers.

What to do on your website

You don't have to be a developer to reduce the risk. This is how I do it:

1. Remove unused plugins and themes. A deactivated plugin still sits on the server. Every one you don't need is unnecessary risk.
2. Turn on automatic updates where it's safe. Small plugins and core security releases can update themselves. Big plugins, like a store or a page builder, I test on a copy of the site first.
3. Check your PHP version with your host. It's usually one click in the control panel. Aim for 8.3 or newer, because 8.2 loses support at the end of 2026.
4. Choose plugins from active authors. Before you install anything, check the last update date and the number of installs. A plugin with no updates for a year is a warning sign.
5. Track vulnerabilities in the plugins you use. Databases like Patchstack or WPScan send alerts about new vulnerabilities.
6. Keep a backup outside the server. If something goes wrong, you restore the site in an hour, not a week.

A website is software, not a poster

You hang a poster once and forget about it. A website needs updates, because it runs code from dozens of different authors. That's why on every site I build I keep the number of plugins low from the start and pick only ones I trust.

If you're planning a new website or want to clean up an old one, check out my website offer. After launch I look after the site for 30 days and show you how to update it safely.

All the best,
Sławek

If you need a website that builds trust and leads to a conversation, see the website offer .