On this page
Eleven thousand flaws, and where they sat
11,334 new vulnerabilities in 2025
- Plugins 91%
- Themes 9%
- WordPress core 6 flaws, all low
- Hour 0Flaw disclosed46 percent still without a fix.
- After 5 hoursFirst attacksWeighted median.
- Same dayAutomatic updateIf you switched it on.
- A week laterUpdated by handOpen for days.
Why updating a week late is too late
WordPress runs almost 40 percent of all websites, which makes it a target. Patchstack, which tracks WordPress vulnerabilities, counted 42 percent more of them in 2025 than the year before. The problem is not the core, which updates itself, but the time between a known flaw and your update: the first attacks come within hours, and for almost half of the flaws no fix existed yet. Wait a week and you are open for days; switch on automatic updates and you close the door the same day.
| Part | Risk | Why |
|---|---|---|
| WordPress core | Low | Few and minor flaws, updates run by themselves |
| Plugins | High | The vast majority of new flaws, often from small vendors |
| Theme | Medium | Heavy themes with page builders bring lots of extra code |
| PHP version | High if old | No more security fixes for 8.1 and older |
| Accounts | Medium | Shared admins, reused passwords |
| Hosting | Medium | Backups on the same server go down with it |
Moving to better hosting? Read moving a website to a new host first: a move without a plan costs you rankings.
Five things to check today
- Switch on automatic updates for the core and for the plugins you trust.
- Remove every plugin you do not use, and every plugin without an update in the past year.
- Ask your host which PHP version the site runs on: at least 8.2, newer is better.
- Turn on two-factor authentication for every admin, and give everyone their own account.
- Check that backups live off the server and that restoring one actually works.
If it is already too late, website hacked, what to do gives the order of steps.
What a hack costs against what upkeep costs
One hour a month to review and test updates costs 720 euro a year at 60 euro an hour. Cleaning a hacked site, restoring it and changing every password quickly takes eight to sixteen hours, 480 to 960 euro. In money the clean-up is not always dearer. The difference is what never shows on an invoice: days or weeks without enquiries, a red warning in Google, and if customer data leaked in the EU, a notification to the data protection authority within 72 hours. For a store that weighs most; what a WooCommerce store needs in upkeep is in is WooCommerce free. If your site runs an older Joomla instead, Joomla vs WordPress shows which versions are still supported.
Security also ties into what your site stores about visitors: every form and every plugin that collects data belongs in your privacy policy. A site that leans on many plugins is often slow too; see why is WordPress so slow, and measure yours with the website speed test. Wondering whether WordPress is still the right choice? Read custom website or WordPress and Webflow or WordPress. If you ship software or plugins yourself, EU rules come with it: see the Cyber Resilience Act reporting obligations.
Compared with Wix, and with a security plugin
Is WordPress less safe than Wix or Shopify?
Different. On Wix and Shopify the platform handles security and you can install little yourself. WordPress gives more freedom and so more responsibility: whatever you install, you have to keep updated.
Do I need a security plugin?
A firewall and an alert on a break-in help, but they do not replace updates. And a security plugin is one more plugin to keep updated.