Report Shows WordPress Sites Are Getting Hacked At Faster Rate

A brand new report concerning the state of WordPress safety referred to as consideration to the hidden menace posed by premium plugins and to the truth that hackers are more and more exploiting vulnerabilities earlier than many websites can patch them.

Safety Is More and more A Race In opposition to Time

The Patchstack WordPress safety firm’s State of WordPress Safety report exhibits that hackers are exploiting the hole between the time a vulnerability is found and a web site will get round to patching it. The standard assumption is that web site house owners have time to guage, patch, and deploy fixes, however that’s more and more now not the case.

The timeline between discovery and web site patch is being compressed by sooner exploitation, typically nearly instantly after disclosure. Defensive processes that rely upon well timed patching turn into a race in opposition to time when exploitation begins inside hours.

The Patchstack report explains:

“When analysing the velocity at which attackers weaponize new vulnerabilities, we discovered that roughly half of excessive influence vulnerabilities get exploited inside 24 hours.

After we account for the way intense the exploitation was (by weighting based mostly on noticed exercise), then the weighted median time to first exploit is 5 hours. This means that probably the most closely focused vulnerabilities are usually attacked inside hours, not days.”

Web site house owners ought to combine this information into their safety workflow to attenuate the time between receiving discover of a vulnerability and patching it.

The Scale of Publicity Is Increasing

The quantity of disclosed vulnerabilities rose sharply in 2025. Most of these vulnerabilities had been present in plugins moderately than WordPress core, inserting the vast majority of publicity within the extension layer maintained by hundreds of unbiased builders.

On the similar time, the report identifies extra pressures affecting WordPress safety:

• Restricted visibility into premium market elements
• Speedy exploitation timelines following disclosure
• Multi-stage, persistent assault habits after compromise

An increasing utility layer that features custom-coded and third-party software program libraries or packages (like JavaScript or PHP elements)

The report explains:

“General 11,334 new vulnerabilities had been discovered within the WordPress ecosystem in 2025 – that’s a 42% enhance in comparison with 2024.

Of all new vulnerabilities discovered, 4,124 (36%) represented an precise menace and had been critical sufficient to require RapidMitigate safety guidelines.

1,966 (17%) vulnerabilities had a excessive severity rating, that means they had been prone to be exploited in automated mass-scale assaults.

In truth, extra high-severity vulnerabilities had been found within the WordPress ecosystem in 2025 than within the earlier two years mixed. This enhance largely got here from premium elements on marketplaces like Envato, and highlights the safety visibility downside of such elements and market. As a result of these elements aren’t available to safety researchers, it’s tougher to search out safety points in them.”

The findings present that danger is distributed throughout each the free plugin ecosystem and premium market elements, the place restricted visibility has made flaws tougher to detect.

Premium Parts Present Excessive Exploitability Charges

Premium market plugins and themes typically obtain much less unbiased scrutiny resulting from restricted code entry. However fewer found vulnerabilities don’t essentially imply decrease danger. Patchstack’s information exhibits {that a} excessive share of vulnerabilities present in premium plugins and themes had been exploitable in real-world assaults.

Patchstack explains:

“To grasp the menace panorama of premium plugins and themes, final yr we carried out targeted analysis on premium marketplaces comparable to Envato.

General we acquired 1,983 legitimate vulnerability experiences for Premium or freemium elements, making up 29% of whole experiences.

59% of these had been excessive Patchstack Precedence vulnerabilities that can be utilized in automated mass assaults.

An additional 17% had medium Patchstack Precedence, that means they are often exploited in additional focused assaults.

Meaning 76% of vulnerabilities present in Premium elements had been exploitable in actual life assaults.

Moreover, our Zero Day program discovered 33 extremely essential vulnerabilities in Premium elements, in comparison with solely 12 in free elements.”

The takeaway is {that a} excessive share of vulnerabilities present in premium elements had been exploitable in real-world assaults.

Delays In Patch Availability

Software program updates are a cornerstone of WordPress plugin and theme safety, however they rely upon fixes being out there when vulnerabilities are disclosed, which isn’t at all times the case. Patch delays depart web site house owners uncovered throughout the interval when exploitation curiosity is highest.

Patchstack shares that plugin and theme builders failed to supply a well timed repair for 46% of vulnerabilities.

Infrastructure Defenses Block Solely a Minority of Assaults

Internet hosting suppliers depend on internet utility firewalls and comparable defenses, however testing confirmed these measures blocked solely a minority of WordPress vulnerability assaults.

Patchstack shares the outcomes of their testing:

“In a large-scale pentest of common webhosting corporations, solely 26% of all vulnerability assaults had been blocked.”

Older Vulnerabilities Stay Energetic Targets

A startling discovering is that attackers proceed to use older vulnerabilities. Patchstack shares that solely 4 of the highest ten vulnerabilities that had been focused probably the most had been revealed in 2025, the remaining had been older.

“When taking a look at high ten vulnerabilities that had been being focused most by attackers, we see that solely 4 had been revealed in 2025.”

They checklist the next older variations of plugins that websites haven’t up to date to secure variations:

• WordPress LiteSpeed Cache Plugin <= 5.7 (2024)
• WordPress tagDiv Composer Plugin < 4.2 (2023)
• WordPress Startklar Elementor Addons Plugin <= 1.7.13 (2024)
• WordPress GiveWP Plugin <= 3.14.1 (2024)
• WordPress LiteSpeed Cache Plugin <= 6.3.0.1 (2024)
• WordPress WooCommerce Funds Plugin <= 5.6.1 (2023)

Publish-Compromise Exercise Emphasizes Persistence

As soon as entry is gained, attackers more and more search to keep up entry after the preliminary compromise moderately than deploy one-time payloads.

Patchstack explains:

“This sustained enhance suggests attackers are transferring past opportunistic, one-off compromises. As an alternative, they’re investing in persistent infrastructure—planting uploaders that allow multi-stage assaults and long-term entry to compromised websites.

Persistent infrastructure means attackers aren’t simply exploiting vulnerabilities as soon as and transferring on. They’re establishing footholds that enable them to return, deploy extra payloads, and keep entry even after preliminary infections are cleaned.”

Trendy malware continuously embeds itself inside legit recordsdata or makes use of runtime strategies to keep away from detection. This makes cleanup harder than merely deleting clearly malicious recordsdata.

The 2026 Outlook

Patchstack initiatives that the code working WordPress websites will proceed increasing past conventional packaged elements. Securing WordPress environments now requires accounting for code that lives exterior customary plugin and theme distributions.

The increasing assault floor consists of custom-built performance, third-party code added by JavaScript or PHP elements, and AI-generated code, all of which can not cross by regular plugin or theme replace channels. The increasing assault floor consists of:

• Customized-coded plugins developed for particular person websites or businesses
• JavaScript and PHP packages pulled into initiatives as dependencies
• AI-generated code used to construct options or complete entrance ends

Securing WordPress now requires visibility into custom-coded and generated elements, not simply put in plugins and themes.

Featured Picture by Shutterstock/Kues