Table of contents9
The call came on a Tuesday morning in March. A nonprofit’s donation site was redirecting visitors to a crypto scam. By the time I got access, the attackers had been inside for eleven days — eleven days of stolen donor data, poisoned search rankings, and a Google “this site may be hacked” warning. The entry point? A contact form plugin with a vulnerability disclosed five hours before the mass exploitation began. Five hours. The site owner updated plugins “when she remembered.” She remembered too late.
I am Daniel Okafor, and I clean up hacked WordPress sites for a living. 2026 was the busiest — and most instructive — year I have seen in this work. The threat landscape did not just grow; it changed shape. Attackers got faster, supply chains got hit, and for the first time in years, WordPress core itself had a genuinely scary moment.
This is my year in review: what actually happened in WordPress security in 2026, backed by numbers from Patchstack, Wordfence, and independent researchers — not headlines. More importantly, it is what those events teach us about defending our sites in 2027. If you run a WordPress site, this is the security briefing you wish you had read in January.
Fair warning: some of these numbers will unsettle you. Good. Unsettled people update their plugins.
Here is what this review covers:
- 2026 by the numbers: the threat landscape in data
- The plugin problem: where 91% of vulnerabilities live
- wp2shell: the core scare of July 2026
- Supply chain attacks: April’s wake-up call
- Brute force and automated attacks at massive scale
- What actually worked: defenses that held in 2026
- Your 2027 defense checklist
- Frequently asked questions
- Final thoughts
Let us start with the data — because in security, feelings lie and numbers do not.
2026 by the Numbers: The Threat Landscape in Data
Patchstack’s State of WordPress Security 2026 report gives us the year’s defining statistic: 11,334 new vulnerabilities were disclosed across the WordPress ecosystem in 2025, a 42% year-over-year increase. That continues a steep climb — 4,528 in 2022, 5,948 in 2023, 7,966 in 2024. The curve is not flattening. In January 2026 alone, one weekly report disclosed 333 vulnerabilities — roughly 48 per day, according to Liquid Web’s tracking.
But the raw count is not the scary part. The scary part is the speed. Patchstack measured the median time from disclosure to mass exploitation at about 5 hours for the most heavily targeted vulnerabilities. And 46% of vulnerabilities had no patch available on the day they were disclosed. Read those two facts together: attackers weaponize new flaws in hours, and nearly half the time there is nothing to update to yet. That gap — between disclosure and patch — is where sites get hacked.
Wordfence’s Q2 2026 threat intelligence report shows the attack volume behind those numbers: 10.4 billion WAF attacks blocked in a single quarter (up 14.3%), 18.2 billion brute force attacks blocked (up 13.8%), and 573,000 infected sites detected (up 21%). High-threat vulnerabilities rose 15.2% even as total published vulnerabilities dipped quarter-over-quarter — meaning fewer bugs overall, but more dangerous ones.
And here is the number that should end the “it won’t happen to me” thinking: the Singapore WordPress security study published August 2026 by Equinet Academy analyzed 102 business WordPress sites and found 80.4% had at least one detectable vulnerability, with a third rated high or critical risk. These were not hobby blogs — they were real businesses. Four out of five were exposed.
The Plugin Problem: Where 91% of Vulnerabilities Live
If 2026 taught one lesson above all others, it is this: WordPress security is a plugin problem, not a core problem. Of the 11,334 vulnerabilities disclosed in 2025, 91% were in plugins (roughly 10,314), about 9% in themes (roughly 1,020), and exactly 6 in WordPress core — less than 0.1%, according to Patchstack’s data via Colorlib’s 2026 roundup.
Let that sink in. The core software running 40% of the web had six disclosed vulnerabilities in a year. The 70,000+ plugins extending it had ten thousand. Every plugin you install is a trust decision — you are handing a stranger’s code the keys to your site — and the ecosystem’s quality variance is enormous. Many plugins are maintained by a single volunteer; some have not been updated in years yet remain installed on thousands of sites.
The vulnerability types tell their own story. Cross-site scripting (XSS) accounted for 47.7% of 2024’s disclosures, but in 2025 broken access control became the most exploited type — flaws that let attackers do things they should not be authorized to do, like the unauthenticated exploits that defined several of the year’s worst incidents. And 43% of 2024’s vulnerabilities required no authentication at all, meaning attackers needed no username, no password — just the vulnerability.
I see this pattern in my cleanup work constantly. The hacked sites are rarely running exotic software — they are running popular plugins, two versions behind, with a vulnerability that was disclosed, weaponized within hours, and patched a week later. The site owner simply never updated. Sucuri’s incident data backs this up: 39.1% of hacked CMS sites were running outdated software at the time of infection. The single most effective security tool in WordPress remains the Update button, used promptly. Our safe update checklist is the process I wish every one of my cleanup clients had followed.
wp2shell: The Core Scare of July 2026
For years, the security community’s comforting mantra was “core is safe, worry about plugins.” In July 2026, that mantra cracked. Researchers disclosed the wp2shell attack chain (CVE-2026-63030 chained with CVE-2026-60137), which gave attackers unauthenticated remote code execution on default WordPress 6.9 and 7.0 installs — no plugins required, no login needed, a bare install taken over.
The flaw was serious enough to be added to CISA’s Known Exploited Vulnerabilities catalog — the US government’s list of flaws that federal agencies are required to patch, reserved for vulnerabilities with confirmed real-world exploitation. When I read that listing, I called every client I had and verified their core version the same day.
Here is the honest analysis, though, not just the scare. The WordPress security team patched it fast, auto-updates pushed the fix to millions of sites within hours, and the incident actually demonstrated the system’s strength: a core flaw was found by researchers, disclosed responsibly, patched quickly, and distributed automatically. Compare that to a vulnerable plugin maintained by one person on weekends. The lesson of wp2shell is not “core is broken” — it is that automatic security updates for core are the most important setting on your site, because even core has bad days. If your site was on the default minor auto-update setting, you were protected while you slept. If you had disabled all auto-updates to “stay in control,” you were exposed until you manually updated.
Our breakdown of a recent WordPress security update shows exactly what these emergency releases contain — and why installing them within hours, not weeks, is the whole game.
Supply Chain Attacks: April’s Wake-Up Call
The most strategically alarming event of 2026 was not a single vulnerability — it was the April 2026 supply chain attack that took more than 25 plugins offline in a single day, as documented by UnfoldCMS. Attackers compromised the distribution channel itself: the mechanism by which plugins reach your site.
Think about what that means. All the advice about “only install from trusted sources” assumes the trusted source stays trustworthy. A supply chain attack breaks that assumption — malicious code arrives through the official update channel you were told to trust. Your site did everything right and still got compromised, because the compromise happened upstream of you.
This is the threat that keeps me up at night, more than any individual XSS bug. Individual vulnerabilities get patched; supply chain attacks undermine the patching system itself. The practical defenses are unglamorous but real: minimize your plugin count (every plugin is a supply chain you depend on), prefer plugins with active maintainers and transparent development, and monitor your site’s integrity so you detect unexpected changes fast. Fewer dependencies means fewer upstream throats to choke you. I now treat “do I really need this plugin?” as a security question, not just a performance one.
Brute Force and Automated Attacks at Massive Scale
While everyone watches vulnerabilities, the background radiation of automated attacks kept intensifying. Wordfence recorded more than 90 billion malicious login attempts against WordPress sites in a single year — roughly 2,800 every second, according to MojoShine’s 2026 analysis. The Q2 2026 numbers (18.2 billion brute force attempts blocked in one quarter) show no letup.
Here is what changed in 2026: the bots got smarter about targeting. Instead of spraying the same password list everywhere, attack campaigns increasingly correlate disclosed vulnerabilities with automated exploitation — scanning for the specific plugin versions affected by that week’s disclosures. The 5-hour exploitation window is not a human with a keyboard; it is infrastructure that turns a vulnerability disclosure into a global scan within hours.
Bonus Tip: The cheapest high-impact defense against all of this is still the boring trio: strong unique passwords, two-factor authentication on every admin account, and limiting login attempts. I have never cleaned up a site that had all three properly configured and was breached through brute force. Not once. The breaches come through unpatched plugins and weak credentials — the basics, ignored.
What Actually Worked: Defenses That Held in 2026
A year in review should not be only doom. Let us talk about what demonstrably protected sites in 2026, because the pattern is encouraging.
Automatic security updates worked. The wp2shell incident is the proof: sites on default auto-update settings received the core patch within hours of release, closing the window before most attack campaigns ramped up. Every cleanup client I had in 2026 who was fully updated was breached through something else — usually a premium plugin updated outside the auto-update system, or credentials. The update mechanism itself held.
Web application firewalls bought critical time. With 46% of vulnerabilities unpatched at disclosure, a WAF with virtual patching — blocking exploitation attempts for known flaws before an official patch exists — is the only defense that covers the disclosure-to-patch gap. Wordfence’s 10.4 billion blocked attacks in Q2 alone is not a marketing number; it is the gap being filled, billions of times.
Backups turned disasters into inconveniences. Every site I restored from a clean backup in 2026 was back online in under an hour. Every site without one became a multi-day forensic project costing ten times more. If you take one action from this article, make it verifying your backups actually restore — our comparison of manual backups versus backup plugins will help you choose, but the choosing matters less than the testing.
Note: Patchstack’s 2025 penetration tests found that traditional defenses blocked only 12% of WordPress-specific attacks. Read that carefully: generic security theater — the kind that looks impressive in a dashboard — mostly failed. What worked was WordPress-specific: timely updates, WAF rules written for WordPress attack patterns, and hardening guided by how WordPress actually gets breached. Generic does not cut it; specific does.
Your 2027 Defense Checklist
Enough analysis. Here is the distilled action list I give every client after a cleanup — the defenses that 2026 proved matter, in priority order.
1. Update everything, fast. Keep core minor auto-updates on, enable auto-updates for trusted plugins, and run a weekly manual update pass for the rest. The 5-hour exploitation window means “I’ll update this weekend” is a risk decision, not a scheduling preference.
2. Cut your plugin count ruthlessly. Audit every installed plugin: do you use it, is it maintained, when was it last updated? Each one is a supply chain and an attack surface. If a plugin has not been updated in over a year, replace it — 2026’s data says unmaintained code is where breaches begin.
3. Harden logins. Two-factor authentication on all admin accounts, strong unique passwords (a password manager, not memory), and login attempt limiting. This closes the brute-force door that 18 billion quarterly attempts are knocking on.
4. Run a WordPress-aware firewall. Generic hosting firewalls are not enough — Patchstack’s 12% figure proves it. You need rules written for WordPress attack patterns, with virtual patching for the disclosure-to-patch gap.
5. Verify your backups restore. Not “I have backups” — “I restored from backup last month and it worked.” Schedule a restore test quarterly. An untested backup is a hope, not a plan.
6. Monitor for changes. File integrity monitoring or a security scanner that alerts you to unexpected file changes catches supply-chain compromises and quiet intrusions early. The nonprofit in my opening story was breached for eleven days because nobody was watching. Do not be nobody.
If the worst has already happened, do not improvise — follow our WordPress hacked recovery guide, which walks through containment, cleaning, and hardening in the right order.
Frequently Asked Questions
Is WordPress safe to use in 2026?
Yes — with maintenance. WordPress core itself had only 6 disclosed vulnerabilities in 2025 out of 11,334 ecosystem-wide; the risk concentrates in plugins (91%). A WordPress site that is updated promptly, runs few well-maintained plugins, uses 2FA, and sits behind a WordPress-aware firewall is a hard target. An unmaintained one is not a WordPress problem — it is a maintenance problem.
What was the wp2shell vulnerability?
wp2shell was a July 2026 attack chain (CVE-2026-63030 + CVE-2026-60137) allowing unauthenticated remote code execution on default WordPress 6.9 and 7.0 installs — no plugins needed. It was patched quickly, added to CISA’s Known Exploited Vulnerabilities catalog, and distributed via automatic updates. Sites with core auto-updates enabled were protected within hours.
What percentage of WordPress hacks come from plugins?
About 91% of disclosed WordPress vulnerabilities in 2025 were in plugins, with roughly 9% in themes and under 0.1% in core (Patchstack). Sucuri’s incident data adds that 39.1% of hacked CMS sites were running outdated software at infection — so the plugin problem is really an outdated-plugin problem.
How fast do hackers exploit new WordPress vulnerabilities?
Patchstack measured a median of about 5 hours from disclosure to mass exploitation for the most heavily targeted vulnerabilities in 2025. With 46% of vulnerabilities unpatched at disclosure, speed of updating — ideally via auto-updates — is the single biggest factor in whether a disclosed flaw becomes your breach.
What is a WordPress supply chain attack?
An attack that compromises the distribution channel — the plugin or theme update system itself — rather than exploiting a code flaw. The April 2026 incident took 25+ plugins offline in a day. Defense means minimizing plugin count, preferring actively maintained plugins, and monitoring your site for unexpected file changes.
Final Thoughts
That nonprofit’s donation site? We cleaned it, hardened it, and set up monitoring. It has been quiet ever since — not because attackers stopped trying, but because the site stopped being the easy target. Every site I cleaned in 2026 taught the same lesson: the breaches were not sophisticated. They were preventable.
Here is my honest summary of WordPress security in 2026: the threat volume grew — 11,334 vulnerabilities, 5-hour exploitation windows, supply chain attacks, billions of automated probes. But the defenses grew too, and the ones that worked were not exotic. Timely updates. Fewer plugins. Strong logins. A real firewall. Tested backups. The unglamorous fundamentals outperformed every fancy dashboard.
2027 will bring new vulnerabilities — that is certain. What is not certain is whether your site will be among the patched or among the breached. That decision is made in the boring moments: the weekly update run, the plugin audit, the backup test. Start with one item from the checklist today. The attackers are already working; it is time you outworked them.
