Quick answer: Most WordPress vulnerabilities are found in plugins and themes, not in WordPress itself. To stay safe, follow a trusted vulnerability feed (WordPress.org security releases, Patchstack, Wordfence Intelligence or WPScan), keep everything updated, remove plugins you don’t use, and act quickly when a plugin you run appears in a report.
Security news can sound scary, but you don’t need to read every headline. You need a simple routine: know where to look, check if your site is affected, update or replace the affected software, and keep backups. This guide shows you how.
What the latest data shows
Patchstack’s State of WordPress Security in 2026 report counted 11,334 new vulnerabilities in the WordPress ecosystem during 2025, a 42% rise on the year before. The key points for site owners:
- 91% were in plugins and 9% in themes.
- Only 6 were in WordPress core, and all were low priority.
- 46% had no fix available from the developer when they were made public.
- Broken access control was the most exploited category.
So the biggest risk isn’t WordPress itself — it’s the add-ons you install, especially ones that are abandoned or rarely updated.
Where to follow WordPress vulnerability news
| Source | What it covers | Best for |
|---|---|---|
| WordPress.org security releases | Official core security updates | Everyone |
| Patchstack Database | Plugin, theme and core vulnerabilities | Checking a specific plugin |
| Wordfence Intelligence | Free vulnerability database and weekly reports | Weekly round-ups |
| WPScan | Vulnerability database and scanner | Developers and agencies |
| CVE.org | Official CVE records | Looking up a CVE number |
You don’t need all of them. Pick one weekly report and one database to search when needed.
How to check if your site is affected
- List what you run. Go to Plugins → Installed Plugins and Appearance → Themes. Note the name and version of each one.
- Search the database. Look up each plugin name in Patchstack or Wordfence Intelligence. Each entry shows the affected versions and the version that fixes it.
- Compare versions. If your version is in the affected range, you need to act.
- Use a scanner. Security plugins can alert you automatically when an installed plugin has a known issue. See our WordPress security guide for options.
What to do when a plugin you use is vulnerable
- Back up first. Take a fresh backup of files and database. Our backup guide explains how.
- Update right away if a fixed version exists. Test on a staging site if the site is business-critical.
- No fix yet? Deactivate the plugin, or replace it with a maintained alternative. Some firewall services offer “virtual patches” that block the attack until the developer releases a fix.
- Check for signs of compromise — unknown admin users, strange redirects, new files, or spam pages in Google.
- Change passwords for admin accounts if there is any chance the flaw was used.
How to understand a vulnerability report
Reports use a few common terms. Knowing them helps you decide how fast to act:
- CVSS score: a 0–10 severity rating. 9–10 is critical; under 4 is low.
- Unauthenticated: an attacker doesn’t need an account. These are the most urgent.
- Subscriber / Contributor+: the attacker needs a user account with that role. Lower risk if you don’t allow open registration.
- XSS (cross-site scripting): lets attackers inject scripts into pages.
- SQL injection: lets attackers read or change your database.
- Broken access control / privilege escalation: users can do things they shouldn’t, sometimes becoming admins.
An unauthenticated, high-score bug in a plugin you use means update today. A low-score bug that needs an admin account is less urgent but still worth fixing.
How to reduce your risk long-term
- Install fewer plugins. Every plugin adds code that could have a flaw.
- Choose maintained software. Check the “last updated” date and support forum before installing.
- Turn on automatic updates for trusted plugins and minor core releases.
- Use strong passwords and two-factor authentication for every admin.
- Pick good hosting. Many managed hosts patch and scan for you — see our WordPress hosting guide.
- Delete unused themes and plugins instead of just deactivating them.
Is WordPress core safe?
Yes, core WordPress has a dedicated security team and a strong track record. Security fixes are released quickly and minor updates install automatically by default. You can read how the project handles security on the official WordPress security page and the hardening guide.
A simple weekly security routine
- Read one weekly vulnerability report (10 minutes).
- Check Dashboard → Updates and apply updates.
- Confirm your latest backup worked.
- Review users for unknown accounts.
That’s it. Fifteen minutes a week stops most problems before they start.
When the vulnerability is in PHP, not WordPress
Most vulnerability news is about plugins and themes, but occasionally a flaw affects the software WordPress runs on. In October 2026, the PHP project fixed two critical flaws known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619) that could let attackers run code on unpatched servers without logging in. Updating WordPress or plugins didn’t fix them — only an updated PHP version on the server did. This kind of event changes your routine: instead of searching plugin databases, you check your PHP version in Site Health and ask your host to confirm the patch. Keep this distinction in mind whenever you read security headlines.
A real-world example
A small agency managing 40 client sites subscribed to a weekly vulnerability report. One Monday, the report listed a critical flaw in a popular slider plugin used on six of their sites. Using their site management dashboard, they updated all six within an hour and checked the sites afterwards. Two weeks later, a wave of automated attacks targeted that exact flaw. Their sites were unaffected. Other sites still running the old version were hacked and had spam injected. The difference was a 10-minute weekly habit.
Tools that make tracking easier
- Security plugins that alert you when an installed plugin has a known vulnerability.
- Site management dashboards that show plugin versions across many sites.
- Your host’s security notifications and status page.
- Weekly email reports from vulnerability databases.
Don’t panic at every headline
Security news often sounds alarming, but most reports affect a small number of sites using a specific plugin version. Check whether you use the affected software, update if you do, and move on. Save your urgency for flaws that are unauthenticated, critical and in software you actually run.
A calm, consistent routine beats reacting to every alarming headline you see.
Bookmark one trusted source and check it every week, ideally at the same time as your updates.
FAQ
Why are there so many WordPress vulnerabilities?
WordPress powers a huge share of the web and has more than 60,000 free plugins, so researchers look at it closely. More reports partly reflect more scrutiny, not just weaker code.
Should I stop using a plugin with a past vulnerability?
Not always. A plugin that fixes issues quickly is often safer than one nobody checks. Worry about plugins that leave flaws unpatched.
Do I need a security plugin?
It helps, especially for alerts and a firewall, but updates, backups and strong logins matter more.
WordPressPrime.com is an independent guide and is not affiliated with the WordPress Foundation, WordPress.org or Automattic. Always back up your website before making changes, and check official sources for the latest details.
