Key points:
- Known code: WordPress, its themes and plugins are public. Anyone who finds a flaw can try it on millions of websites at once.
- Plugins as the way in: About 91 % of new vulnerabilities in the WordPress ecosystem sit in plugins, not in core. Every plugin is another door.
- Hours, not weeks: For heavily targeted flaws, it takes a median of just 5 hours until mass exploitation. Updating at the weekend is too late.
- AI speeds up attackers: Germany’s federal cyber security agency BSI warns that AI lowers the effort, time and skill needed for attacks. Widespread systems are hit first.
- Less is safer: A lean website without a CMS and a pile of plugins offers less attack surface – and is not a mass target.
Is WordPress really secure?
It would be wrong to say that every WordPress website is bad or insecure. There are well-maintained installations with few plugins, daily updates and a good firewall. In our day-to-day work, however, we mostly see the opposite: websites that have grown over the years, with many extensions, an outdated theme and nobody checking in every day.
What does “hacked” actually mean? A hack can mean many things: injected ads or redirects that get the site penalised by Google, contact data skimmed from forms, a website that is offline for days – or extortion. Attackers who are after money and data do not pick your business on purpose. They look for every website with the same flaw.
This is exactly why the size of WordPress is a problem. According to W3Techs, WordPress powers 39.5 % of all websites worldwide (W3Techs). The source code is open, the most popular plugins are well known, and their versions can often be read from outside. As soon as a plugin flaw becomes public, automated tools scan for every website running that plugin – worldwide, around the clock.
Patchstack’s figures show how big the field is: in 2025, 11,334 new vulnerabilities were reported in the WordPress ecosystem, 42 % more than the year before. That is roughly 31 new vulnerabilities per day. About 91 % were in plugins and only six in WordPress core itself. For 46 %, no fix was available when they were disclosed (Patchstack). Wordfence counted 1,339 new vulnerabilities in just three weeks from mid-October to early November 2026 – about 64 per day (Wordfence).
Core is not spared either: at the end of October 2026, WordPress 7.1.4 closed a flaw that lets attackers run malicious code. Exploit attempts started on the day of the release; the Wordfence firewall blocked more than 240,000 of them in about eight days, roughly 30,000 per day (Wordfence). Back in September 2026, another core flaw was attacked just hours after the patch (heise online).
Why AI keeps pushing the risk up
Attacks used to take knowledge, time and manual work. Today, AI tools do much of it: they read security advisories, turn them into exploit code and try it automatically on thousands of websites. The BSI puts it plainly: AI significantly lowers the effort, time and entry barriers for offensive cyber capabilities. Its advice is to reduce the attack surface as a matter of principle (BSI).
Patchstack sees the same in its numbers: for heavily targeted flaws, the weighted median until mass exploitation is just 5 hours, and about half of the severe vulnerabilities were exploited within 24 hours. Hosting firewalls stopped only 12 % of WordPress-specific attacks. With the Bricksforge plugin, attacks even began before the flaw was made public (Patchstack). In a study by the BSI and the German TÜV association, 17 % of companies surveyed reported AI-related attacks within twelve months; only 11 % have set procedures for such incidents (BSI).
And the PHP flaw? In October 2026, “PHP2Shell” became public: two critical vulnerabilities in PHP itself which, according to heise, affected all PHP versions of the last 20 years. In Germany alone, Censys counted about 4.2 million vulnerable PHP services (heise online).
To be honest: a flaw like this hits every website running PHP – lean ones included. The only remedy is a host that updates quickly. The difference lies in everything else: a WordPress installation adds dozens of plugins and themes, each of which can have its own flaws, plus a login area at an address everybody knows. A lean website simply does not have that second and third door.
How to get out of the line of fire
- Take stock: Which plugins and themes are running, which are no longer maintained, and who installs the updates? That list is the first step.
- Secure it now: Until you switch: install updates daily, delete unused plugins, protect the login with a second factor and keep a backup off-site.
- Rebuild lean: Keep your texts, images and structure and rebuild the website without a CMS and without a pile of plugins. Content is maintained in a separate tool instead of a well-known admin area.
- Move and redirect: Redirect old addresses properly so your Google rankings are kept, and remove the old WordPress installation completely.
- Keep checking: Check backups, host updates and anything unusual on a regular basis – automatically, with an alert when something is wrong.
How we build websites today
We worked with WordPress for a long time ourselves and know its strengths. That is exactly why we now build websites without a classic CMS: lean code, no plugin collection, no login page at an address every attacker knows. That does not make such a website unbreakable. But it is not part of the big mass target that automated attacks aim at – and that is where most of the damage happens.
You maintain texts, images and pages in the webentwickler.io CRM. It brings a lot to the table for security:
- Two-step login: in addition to the login link, we ask for a code from your authenticator app.
- Backups that speak up: your website is backed up regularly. If something goes wrong, you see it right away and get an email.
- A second copy with us: if your website is hosted elsewhere, we also keep the backups on our server in Germany.
Frequently asked questions
Is WordPress secure?
WordPress core itself is well maintained: in 2025, only six of the reported vulnerabilities affected it. The risk comes from plugins, themes and missing updates. Because WordPress is so widespread, every flaw is especially attractive to attackers.
My WordPress site was hacked – what now?
Take the site offline or put it into maintenance mode, change all passwords, restore a clean backup from before the attack and close the hole. If personal data is affected, you may have to notify the data protection authority, usually within three days.
Isn’t a security plugin enough?
A security plugin helps, but it is yet another plugin that has to be kept up to date. According to Patchstack, hosting firewalls stopped only 12 % of WordPress-specific attacks. Less attack surface beats more layers of protection.
Are websites without a CMS unhackable?
No. They also run on a server, often with PHP, as the PHP2Shell flaw has shown. But they offer far less attack surface and are not a worthwhile mass target.
How much work is it to move away from WordPress?
Texts, images and addresses are carried over and old addresses are redirected. How long it takes depends on the size; for most small business websites it is a manageable project.