What are the most common causes of WordPress site breaches?

The vast majority of WordPress breaches result from plugin and theme vulnerabilities – accounting for over 90% of successful attacks. Other causes include weak passwords and brute force attacks, outdated WordPress versions, lack of server-level security, and improper file permission configuration.

Know-how

WordPress Security in 2025/2026 – Threats, Statistics, and Practical Protection

Q: Is WordPress itself secure?

WordPress core is actively developed and regularly updated for security. The number of vulnerabilities in the core itself is relatively low – threats primarily come from the plugin and theme ecosystem. WordPress is secure provided regular updates, proper server configuration, and hardening practices.

Q: How often should I update WordPress and plugins?

Security updates should be applied as quickly as possible – ideally within 24 hours of release. Data shows that the first exploitation attempts of new vulnerabilities appear within hours of disclosure. Functional updates can be tested on staging before production deployment.

Q: Are security plugins enough to protect WordPress?

No. Security plugins are one layer of protection but cannot replace proper server configuration, system firewall, regular updates, strong passwords, two-factor authentication, and backups. Effective protection requires a multi-layered approach – from server, through application, to incident response procedures.

Q: What should I do if my WordPress site has been hacked?

Immediately isolate the site from public traffic, change all passwords (database, FTP, WordPress panel, hosting account), scan files for malware, restore the site from a clean backup, update all components, and conduct an audit to identify the attack vector. After restoration, implement additional security measures to prevent re-occurrence.

Published: March 20, 2026 · Author: Marcin Szewczyk-Wilgan

WordPress powers over 40% of all websites worldwide. This popularity is both its greatest strength and its greatest weakness – it makes WordPress the primary target for cybercriminals. In 2025, over 11,000 new vulnerabilities were discovered in the WordPress ecosystem, a 42% increase compared to 2024. The first exploitation attempts appear within hours of a vulnerability being disclosed. In this article, we analyze the current threat landscape, the most common attack vectors, and – most importantly – specific actions that effectively protect WordPress sites.

The Scale of Threats – Numbers Worth Knowing

Data from 2025 security reports clearly shows that threats to WordPress sites are growing faster than ever. These are not abstract statistics – behind every number is a real risk of losing data, customers, and reputation.

11,334 new vulnerabilitiesThat many new security flaws were discovered in the WordPress ecosystem in 2025 – a 42% increase over 2024. On average, over 30 new vulnerabilities every day. The vast majority affect plugins and themes, not WordPress core itself.

92% of breaches via pluginsOver 9 out of 10 successful attacks on WordPress sites in 2025 came from plugin and theme vulnerabilities – not from CMS core flaws. Plugins are the weakest link in the ecosystem and the primary attack vector.

Exploitation in 5 hoursThe first automated attacks exploiting a newly disclosed vulnerability appear on average within 5 hours of publication. The first 24 hours after disclosure are the critical window – every hour of delay in updating increases risk.

43% without authenticationNearly half of WordPress vulnerabilities are exploitable without login – the attacker does not need any credentials to compromise the site. This means password changes alone are not sufficient as a protection strategy.

96% experienced an incidentA 2025 Melapress study found that 96% of WordPress professionals experienced at least one security incident, and 64% reported a full breach. The question is not “if” a site will be attacked, but “when.”

Most Common Attack Vectors on WordPress

Understanding how attackers reach WordPress sites is the foundation of effective protection. These are the vectors responsible for the vast majority of successful breaches:

Plugins and themes

Extension vulnerabilities

The biggest threat to WordPress. Outdated, abandoned, or poorly coded plugins are open doors for attackers. In 2025, over half of plugin developers did not release a security fix before public disclosure. Every unused plugin is a potential vulnerability.

Brute force

Login brute-force attacks

Automated password guessing attempts on the WordPress panel. In 2025, brute force attacks increased by 45%, driven by AI-powered botnets. Bots can bypass traditional CAPTCHA and mimic human login patterns.

XSS and CSRF

Malicious code injection

Cross-Site Scripting (XSS) and Cross-Site Request Forgery (CSRF) are among the most common vulnerability types in the WordPress ecosystem. XSS allows attackers to inject scripts into pages, CSRF – to execute unauthorized actions on behalf of a logged-in user.

Abandoned plugins

Plugins without developer support

Plugins whose authors have stopped development will never receive security patches. They remain on the site as permanent vulnerabilities. Regular audit of installed extensions and removal of inactive or unupdated plugins is a basic security hygiene element.

Multi-Layered Protection – The Only Effective Approach

WordPress security is not about installing one plugin. Research shows that traditional WAF solutions block only 12–26% of WordPress-specific attacks. Effective protection requires multiple layers – from server, through application, to operational procedures. Each layer stops a different type of threat.

Layer 1: ServerOperating system hardening, firewall configuration (iptables/nftables), SSH access restriction, disabling unused services, current PHP version with proper configuration (open_basedir, disable_functions), process isolation. This is the foundation on which everything else rests.

Layer 2: Web serverNginx or Apache configuration: security headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Strict-Transport-Security), blocking access to sensitive files (wp-config.php, .htaccess, xmlrpc.php), request rate limiting, SSL/TLS certificate.

Layer 3: WordPress applicationRegular core, plugin, and theme updates. Disabling the file editor in the panel (DISALLOW_FILE_EDIT). Changing the database table prefix. Restricting user account permissions. Removing unused themes and plugins. Blocking user registration if not required.

Layer 4: AuthenticationStrong, unique passwords for every account. Two-factor authentication (2FA) for all administrative and editorial roles. Limiting login attempts. Changing the default wp-login.php address. Blocking XML-RPC if not in use.

Layer 5: MonitoringWAF (Web Application Firewall) with WordPress-specific rules. Daily file scanning for malware and unauthorized changes. Core file integrity monitoring. Logging and analysis of suspicious activity. Alerts about new vulnerabilities in installed plugins.

Layer 6: Backup and recoveryDaily file and database backups – stored in an external location (not on the same server). Regular restore testing. Backup versioning with minimum 30-day retention. Incident response plan with defined steps and responsibilities.

Updates – The Most Important Protection Element

Regular updates are the single most effective measure for protecting a WordPress site. The vast majority of successful attacks exploit vulnerabilities for which official patches already exist – but site owners have not applied them.

Security updatesSecurity patches should be applied within 24 hours of release. With exploitation time measured in hours, every day of delay is a day of exposure to known, documented attacks. At WebOptimo, we monitor vulnerabilities and deploy patches as part of WordPress care plans.

Functional updatesUpdates introducing new features – unlike security patches – should be tested on a staging environment first. This allows detecting conflicts with other plugins, the theme, or custom code before deploying to the production site.

PHP versionAn outdated PHP version is a threat many site owners are unaware of. Older PHP versions do not receive security patches – a site on PHP 7.4 runs on software unsupported since November 2022. Migrating to a current PHP version is a critical security element.

Plugin auditRegular review of installed plugins and themes: are they still maintained? When was the last update? Are there known vulnerabilities? Plugins not updated for 6+ months should be removed or replaced. Fewer plugins = smaller attack surface.

New Threats: AI and the Cyber Resilience Act

The WordPress security landscape is changing not only due to technology but also regulation. Two phenomena defining 2026 are the use of AI by attackers and the EU Cyber Resilience Act (CRA).

AI in attacks

Artificial intelligence on the attacker’s side

AI enables mass scanning of sites for vulnerabilities, generating exploit scripts, and creating polymorphic malware that evades signature-based scanners. AI-assisted botnets can bypass CAPTCHA and generate contextual phishing comments.

AI in code

AI-generated code

2025 research indicates that approximately 45% of AI-generated code contains security vulnerabilities. Custom plugins and components created with AI assistance do not undergo WordPress.org repository review processes – creating an invisible attack surface.

Cyber Resilience Act

New regulatory obligations from 2026

The EU Cyber Resilience Act (CRA) requires that from September 2026, every commercial WordPress plugin available in the EU must have a vulnerability disclosure program (VDP). This is a groundbreaking change – it forces formalization of security processes in the WordPress ecosystem.

Supply chain

Supply chain attacks

Attackers target plugin developers – hijacking accounts, injecting malicious code into updates, buying abandoned plugins. Users install the infected update unaware of the threat. Verifying plugin sources and authors is becoming critical.

What to Do When a WordPress Site Has Been Hacked

Even with the best security measures, an incident can occur. Speed and systematic response are critical. Here is the procedure we follow at WebOptimo when responding to security incidents:

1. IsolationImmediately cut the site off from public traffic – enable maintenance mode or disable the domain. The goal is to prevent further malware spread and protect visitors from malicious code.

2. Password changeChange all passwords: MySQL database, FTP/SFTP, WordPress panel (all administrators), hosting account, SSH keys. Regenerate WordPress security keys (AUTH_KEY, SECURE_AUTH_KEY, etc.) in wp-config.php.

3. Analysis and scanningScan all files for malware. Compare WordPress core files with original versions. Check the database for injected code (especially wp_options and wp_posts tables). Identify the attack vector – which plugin or vulnerability was exploited.

4. RestorationRestore the site from a clean backup from before the incident. If a clean backup is not available – manually remove malicious code, replace core files with fresh ones, update all components. Test the site before relaunching.

5. HardeningAfter restoration, implement additional security measures: WAF, 2FA, server hardening, file integrity monitoring. Document the incident – attack vector, detection time, actions taken. Knowledge from one incident protects against the next.

Summary

WordPress security is not a one-time action but a continuous process. The growing number of vulnerabilities, shrinking exploitation windows, and increasingly sophisticated attacker tools require a proactive, multi-layered approach. Regular updates, server and application hardening, monitoring, backups, and conscious audit of installed components – these are the elements that together create effective protection. None of them is sufficient on its own.

At WebOptimo, security is an integral part of every WordPress care plan. We monitor vulnerabilities, deploy updates, configure server and application-level security, perform daily backups, and respond to incidents. If you want to secure your WordPress site or need help after a breach – contact us or check our WordPress security and WordPress care offer.

Frequently Asked Questions About WordPress Security

What are the most common causes of WordPress breaches?+

The vast majority result from plugin and theme vulnerabilities – over 90% of successful attacks. Other causes: weak passwords, brute force, outdated WordPress, lack of server-level security, and improper file permissions.

Is WordPress itself secure?+

WordPress core is actively developed and regularly updated. Core vulnerability count is relatively low – threats come mainly from the plugin/theme ecosystem. WordPress is secure with regular updates, proper server configuration, and hardening.

How often should I update WordPress and plugins?+

Security updates – as quickly as possible, ideally within 24 hours. First exploitation attempts appear within hours of disclosure. Functional updates can be tested on staging before production deployment.

Are security plugins enough to protect WordPress?+

No. Security plugins are one layer but cannot replace server configuration, system firewall, updates, strong passwords, 2FA, and backups. Effective protection requires a multi-layered approach.

What should I do if my WordPress site has been hacked?+

Immediately isolate the site, change all passwords, scan for malware, restore from a clean backup, update all components, and audit to identify the attack vector. After restoration, implement additional security to prevent re-occurrence.