WordPress runs more than 43% of the web, which makes it the most common target on the internet. Patchstack's State of WordPress Security in 2026 report counted 11,334 new vulnerabilities in the WordPress ecosystem during 2025, a 42% rise on 2024, and almost all of them were in plugins rather than WordPress itself. This guide summarises what changed, how quickly attackers move, and the hardening steps that cut most of the risk.
The state of WordPress risk in 2026
WordPress.org says the software powers more than 43% of the web and is backed by a security team of more than 50 experts, including lead developers and security researchers. Core itself is in good shape: Patchstack recorded only six core vulnerability reports in 2025, all low priority.
The ecosystem around core is another matter. Patchstack counted 11,334 new vulnerabilities in 2025, up 42% on 2024. It rated 1,966 of them, or 17%, as high severity and likely to see mass exploitation, and said highly exploitable vulnerabilities rose 113% year on year. In short, the risk on a typical site comes from the plugins and themes you add.
Where vulnerabilities come from
Plugins accounted for 91% of new vulnerabilities in 2025 and themes for 9%. Paid components are not safer by default. Patchstack logged 1,983 valid reports in premium plugins and themes, 29% of the total, and found 76% of them exploitable in practice, with three times as many known exploited vulnerabilities as free components.
Broken access control was the most exploited category, meaning flaws that let a visitor or low-level user do something only an admin should. Of the ten most exploited vulnerabilities, only four were published in 2025. The rest were older, which shows that sites left unpatched for months remain easy targets.
| Measure (2025) | Figure | What it means for site owners |
|---|---|---|
| New vulnerabilities | 11,334 (up 42%) | Expect weekly plugin security updates |
| Found in plugins | 91% | Every extra plugin adds risk |
| Found in themes | 9% | Keep only one active theme and a default fallback |
| WordPress core reports | 6, all low priority | Core updates are low risk to apply |
| Unpatched at disclosure | 46% | Sometimes removal is the only fix |
| Premium component reports | 1,983 (29%) | Paid plugins need the same scrutiny |
How fast attackers move
Speed is the biggest change. Patchstack measured a weighted median of five hours from disclosure to mass exploitation for heavily exploited vulnerabilities, and about half of high-impact vulnerabilities were exploited within 24 hours. A site that checks for updates once a month is exposed for weeks.
Worse, 46% of vulnerabilities had no patch at the time they were made public. For those, the only safe choices are to disable the plugin, replace it, or rely on a virtual patch at the firewall until the developer ships a fix. Monitoring disclosures for the plugins you run is now part of basic maintenance.
Hardening settings from WordPress.org
The official Hardening WordPress guide sets out a short list of high-value settings. Files should be 644 and directories 755, only the wp-content folder should be writable by the web server, and wp-config.php should be readable only by you and the server, typically 400 or 440. Adding the DISALLOW_FILE_EDIT constant to wp-config.php turns off the dashboard code editor, which blocks a common step after an attacker logs in.
The guide also recommends strong unique passwords with two-step authentication, changing the default wp_ table prefix, renaming the default admin account, giving the database user only the privileges it needs, using SFTP instead of FTP, and requiring HTTPS for the admin area.
- File permissions 644, directories 755, wp-config.php 400 or 440
- define( 'DISALLOW_FILE_EDIT', true ); in wp-config.php
- Two-step authentication for every admin and editor
- No account named admin; non-default table prefix
- SFTP only, and HTTPS enforced for wp-admin
Updates and plugin hygiene
WordPress has supported automatic updates since version 3.7, and only the latest release is officially supported, with security fixes shipped in bugfix releases. Leave automatic core updates on. For plugins, enable automatic updates for well-maintained ones and check the rest at least weekly, given the five-hour exploitation window.
Delete plugins and themes you do not use rather than just deactivating them, and download only from WordPress.org or the developer's official site. Before installing a new plugin, check when it was last updated and whether the developer responds to security reports. Fewer plugins means fewer vulnerabilities to track.
Firewalls, hosting and CDNs
A web application firewall adds a layer, but do not assume your host already covers you. In Patchstack's penetration tests, traditional hosting defences blocked only 12% of WordPress-specific attacks in the first round and 26% of a broader set in the second, with large differences between hosts using similar tools.
A CDN such as Cloudflare includes a WAF and the Free Managed Ruleset on its free plan, and full managed rules from Pro, listed at USD 20 a month billed annually. Use a WordPress-aware firewall or virtual patching service alongside it for plugin-specific flaws.
Backups, logs and monitoring
The WordPress hardening guide recommends regular backups that include the database, kept as multiple dated copies in a trusted location and protected by encryption or read-only storage. Test a restore at least once a quarter; a backup you have never restored is a guess.
Keep web server access and error logs for investigations, and monitor file changes on executable files such as .php so that an unexpected new file raises an alert. Monarx data in the Patchstack report showed malicious uploads nearly tripled in November and December 2025, so holiday periods need extra attention.
If your WordPress site is hacked in India
Take the site offline or into maintenance mode, change every admin password, rotate database and API keys, and restore from a clean backup before reapplying updates. Then find the entry point, usually an outdated plugin, so the same flaw is not reopened.
Indian businesses may also have reporting duties. CERT-In's April 2022 directions require covered entities to report incidents within six hours and keep logs for 180 days. If customer personal data was exposed, the DPDP Rules notified in November 2025 require affected people to be told without delay. XDQ Labs offers authorised WordPress security reviews and fixes for teams that want a second pair of eyes.
Frequently asked questions
Is WordPress secure in 2026?
WordPress core is well maintained, with only six low-priority core vulnerability reports in 2025 according to Patchstack. The risk comes from plugins and themes, which made up all of the remaining 11,334 new vulnerabilities. A site with few, updated plugins and two-step admin sign-in is in good shape.
What file permissions should WordPress use?
WordPress.org's hardening guide recommends 644 for files and 755 for directories. Only the wp-content folder should be writable by the web server, and wp-config.php should be readable only by you and the server, typically set to 400 or 440.
How quickly are WordPress plugin vulnerabilities exploited?
Very quickly. Patchstack measured a weighted median of five hours to mass exploitation for heavily exploited vulnerabilities in 2025, and about half of high-impact flaws were exploited within 24 hours. Weekly or automatic plugin updates are the minimum safe cadence.
Does my hosting company protect my WordPress site?
Only partly. In Patchstack's tests, traditional hosting defences blocked 12% of WordPress-specific attacks in one round and 26% of a broader set in another. Add your own updates, two-step sign-in, backups and a WordPress-aware firewall.
Sources
- State of WordPress Security in 2026, Patchstack, 2026
- Hardening WordPress, WordPress Developer Resources, 2026
- Security (About WordPress), WordPress.org, 2026
- Cloudflare plans and pricing, Cloudflare, 2026
- Cloudflare Web Application Firewall documentation, Cloudflare Docs, 2026
- The CERT-In Cyber Security Directions: More Questions Than Answers, Cyril Amarchand Mangaldas, 2022
- Digital Personal Data Protection Rules, 2025: backgrounder, Press Information Bureau, Government of India, 2025
