Why do WordPress sites get hacked? Where the flaws are

Why attackers aim at WordPress, where the flaws are (91% in plugins in 2025), how fast attacks follow, and what you can do about it.

Key points

WordPress runs 39.2% of all websites, according to W3Techs in November 2026. A flaw in a popular plugin reaches many sites at once, so attackers search for it automatically.
In 2025, the security company Patchstack counted 11,334 new flaws in WordPress plugins, themes, and core. 91% were in plugins, and only 6 were in WordPress itself.
Heavily exploited flaws were first attacked about five hours after they became public. Updates protect you, but 46% of the flaws had no fix at that point.

Why attackers aim at WordPress

WordPress is the most common system for building websites. W3Techs counts it on 39.2% of all websites and on 57.9% of the websites whose content management system it can identify (November 12, 2026).

For an attacker, this means one tool works on millions of sites. Every WordPress site has the same login page and the same folders. A bot only has to find out which plugins a site uses and in which version. The guide How do bots find WordPress sites? shows the traces that give this away.

Most attacks are not aimed at you personally. Bots try every site they find. A small blog is as useful to them as a big shop, for example for spam pages or for redirects to scam sites.

Where the flaws are

Patchstack, a company that collects flaws in WordPress software, counted these for 2025:

Where	New flaws in 2025
Plugins	91%
Themes	9%
WordPress core	6, all of low priority
Total	11,334, 42% more than in 2024

Every plugin adds code from another developer. Some plugins come from large companies, many from a single person. A site with 30 plugins depends on the care of 30 developers. WordPress itself is examined closely: Patchstack counted only six flaws in its core.

How fast attacks follow

When a flaw becomes public, attackers match it against the sites their bots have found. Patchstack measured that heavily exploited flaws were first attacked about five hours after disclosure. About half of the high-impact flaws were attacked within 24 hours.

A fix only helps once it is installed. For 46% of the flaws, the developer had no fix ready when the flaw became public. Then you can only remove the plugin or block the attack before it reaches your site, for example with a firewall rule.

Security plugins have flaws too

This archive counted the CVE entries for the plugins listed on this site. A CVE entry is a public record of a security flaw. These are the entries in the US National Vulnerability Database (NVD) that concern each plugin itself and were published since 2021:

Tool	Own CVE entries since 2021	Newest entry
Wordfence	1	September 2022
Sucuri	2	August 2026
BlogVault	1	August 2026
UpdraftPlus	12	September 2026

A security plugin is code like any other plugin. More entries do not simply mean less safety, because popular plugins are examined more often. What counts is that flaws are fixed fast and that you install the fix.

What you can do

Turn on automatic updates for plugins and themes. Since version 5.5 of August 2020, WordPress lets you do this for each plugin and theme.
Delete what you do not use. A deactivated plugin is still on the server. Fewer plugins mean fewer chances for a flaw.
Check when a plugin was last updated on its page on WordPress.org before you install it. A plugin that has not been updated for a long time may no longer get fixes.
Keep backups outside the server, so that you can restore the site after an attack.
Block attacks before they reach your site while a flaw has no fix yet. A web application firewall filters known attack patterns.

Next step

The page Web security tools lists firewalls, backup plugins, and security plugins with their figures from WordPress.org and their CVE entries.

The figures in this guide come from the archive and change with every data update. As of November 13, 2026.