The 2026 WordPress Security Numbers Are In. Here's What They Mean for You.

Every year, the security firm Patchstack publishes a comprehensive report on the state of WordPress security. The 2026 edition, produced with malware intelligence firm Monarx, is the most detailed picture yet of what site owners are actually up against.

The numbers are striking. But numbers alone don't help you make decisions. Here's what each key statistic actually means if you run a business on WordPress — and what to do about it.

11,334 New Vulnerabilities in One Year

In 2025, Patchstack identified 11,334 new vulnerabilities in the WordPress ecosystem — a 42% jump from 7,966 the year before. Highly exploitable vulnerabilities rose 113% year over year.

What it means for you: The problem isn't slowing down, it's accelerating. This isn't about one famous exploit you can watch out for — it's a constant stream of new flaws, more than 30 per day on average. Staying secure isn't a one-time task; it's ongoing operational work.

91% of Vulnerabilities Are in Plugins

Of all those vulnerabilities, 91% were found in plugins, 9% in themes, and just 2 in WordPress core.

What it means for you: WordPress core itself is remarkably secure — the core team's strict review process shows in the numbers. Your risk lives almost entirely in the plugins and themes you add. The average WordPress site runs 20 to 30 plugins, and every one is third-party code with deep access to your site. The more plugins you run, the larger your attack surface. The single easiest security improvement most sites can make is removing plugins they installed but no longer use.

A 5-Hour Median to Exploitation

When Patchstack measured the time between a vulnerability being made public and the first real attack exploiting it, the weighted median was 5 hours. About 45% were exploited within 24 hours, and 70% within 7 days.

What it means for you: The old advice — "log in once a week and run your updates" — no longer protects you. By the time you sit down for your weekly maintenance, a vulnerability disclosed on Monday morning has been actively exploited since Monday lunchtime. Meaningful protection requires either near-real-time patching or a firewall that can block exploitation attempts before you've had a chance to update. Manual weekly maintenance is patching after the wave has passed.

46% of Vulnerabilities Had No Patch at Disclosure

Perhaps the most important number: 46% of vulnerabilities disclosed in 2025 had no fix available from the developer when they became public.

What it means for you: This is the statistic that breaks the "just keep everything updated" advice. Nearly half the time, when a vulnerability goes public, there is nothing to update to — the developer hasn't released a patch yet. During that window, your only protection is a security layer that doesn't depend on the vendor: a web application firewall, active monitoring, and virtual patching that can block the exploit even before an official fix exists.

Premium Plugins Aren't a Safe Zone

A common assumption is that paid plugins are more secure than free ones. Patchstack's data says otherwise: of the vulnerabilities found in premium and freemium components, 76% were exploitable in real-world attacks.

What it means for you: Paying for a plugin doesn't buy you security. Premium components actually receive less independent security scrutiny, because their code is harder for researchers to access. "It's a paid plugin" is not a security strategy.

The Bottom Line

Put the numbers together and a clear conclusion emerges. WordPress security in 2026 is:

• Constant — 30+ new vulnerabilities a day, not occasional events
• Fast — exploitation in hours, not weeks
• Beyond simple updating — nearly half of flaws have no patch when disclosed
• Concentrated in add-ons — plugins and themes, free and paid alike

This is why the "set it and forget it" approach to WordPress fails, and why manual monthly or weekly maintenance is increasingly inadequate for a business-critical site. The gap between disclosure and exploitation is now measured in hours, and the defense has to operate on that same timescale.

How WPSecureGuard Closes the Gap

WPSecureGuard is built around exactly this reality. With 25+ years of experience in WordPress and PHP security, we provide continuous monitoring, a managed firewall, rapid patching, and — critically — protection that doesn't wait for a vendor to release a fix.

If a business depends on its WordPress site, the 5-hour exploitation window is not something manual maintenance can cover. See how ongoing protection works →

Source: Patchstack, State of WordPress Security in 2026.