Is WordPress safe in 2026?

WordPress core is well looked after, but a WordPress site is only as safe as its plugins, themes, server and passwords. Patchstack found only 6 new vulnerabilities in core in 2025, against 11,334 across plugins, themes and core together. So WordPress can be run safely, and it takes steady work to do it.

Fairness matters here. Most of what you read about WordPress being unsafe is about neglected sites. A site with a short plugin list, an owner who updates it and a host that keeps PHP current is a different thing from one that has not been touched in a year. The risk sits in how the site is run.

WordPress does well at the part its own team controls. When a serious flaw appeared in core in July 2026, WordPress released version 7.0.2 on 17 July, with fixes in 6.9.5 and 6.8.6, and turned on forced updates for affected sites. Wiz dates the public chain to the same day, 17 July 2026.

That flaw, called wp2shell, chained two bugs: CVE-2026-63030 in the REST API's batch endpoint and CVE-2026-60137, an SQL injection in a database query. Core is not immune, then. What the episode shows is the response: a fix on the day the chain went public, pushed to affected sites without waiting for their owners to click.

Two details the table leaves out. The 17 July release also turned on forced updates for affected sites. On 21 October WordPress said it is not releasing an update, because the two critical flaws are in PHP, not in WordPress.

Patchstack counted 11,334 new vulnerabilities across WordPress in 2025, up 42% on 2024. Of those, 91% were in plugins and 9% in themes, and 4,124, or 36%, were serious enough to need active protection rules. Plugins, not WordPress itself, account for almost all of the problem.

• 11,334

  new vulnerabilities in 2025, up 42% on 2024

  Patchstack, State of WordPress Security in 2026

• 91%

  were in plugins, 9% in themes, 6 in core

  Patchstack, State of WordPress Security in 2026

• 4,124

  needed active protection rules, 36% of the total

  Patchstack, State of WordPress Security in 2026

• 46%

  had no developer fix when they were made public

  Patchstack, State of WordPress Security in 2026

• 113%

  year-on-year rise in highly exploitable vulnerabilities

  Patchstack, State of WordPress Security in 2026

• 5 hours

  weighted median time to first exploit for heavily exploited vulnerabilities

  Patchstack, State of WordPress Security in 2026

• 26%

  of attacks blocked in host tests, 12% in the first

  Patchstack, State of WordPress Security in 2026

A vulnerability is a flaw that could be abused, not a break-in. Most get fixed, and many never see an attack. The ones that matter are serious, reachable without logging in, and unpatched. That is why the 4,124 figure says more than the headline count: about one in three needed active protection.

A count of vulnerabilities is not a count of hacked sites, and Patchstack sells WordPress protection, so read the figures as a guide to where the risk is. The direction is hard to argue with. The number is rising, and the weak spot is the part you choose and install yourself.

WordPress gets into trouble outside core. Plugins carry 91% of new vulnerabilities and themes 9%, nearly half arrive with no developer fix, and attackers move fast: Patchstack's weighted median time to first exploit is 5 hours for heavily exploited flaws. A site that updates once a month can stay exposed for weeks.

The server counts too. WordPress runs on PHP, and PHP2Shell, fixed on 21 October 2026, was a reminder that a flaw in the layer underneath can reach every site on it. We cover that in our PHP2Shell guide. WordPress said it is not releasing an update for it, so the fix sits with your host.

One detail the table leaves out: WordPress core's rating is small, but a critical flaw in core was fixed on 17 July 2026, which is why automatic updates matter.

A security plugin or host firewall helps, but it does not solve the problem. In Patchstack's tests of popular hosting companies, only 26% of vulnerability attacks were blocked, and 12% in the first test, which used known exploited WordPress flaws. Firewalls reduce risk, and updating still matters most.

A well-run WordPress site needs a named person, a short plugin list and a routine. Someone must own updates for core, plugins, themes and PHP, remove what is unused, keep tested backups, and protect every administrator login with a unique password and two-factor sign-in. None of it is hard, but all of it is ongoing.

• A named owner. One person, or one provider, is responsible for updates. Without a name, nobody does them.
• A short plugin list. Every plugin is code someone else wrote and you must keep patched. Delete the ones you do not use.
• Updates within days. With a median of 5 hours from disclosure to first exploit for the worst flaws, a monthly routine leaves a long gap.
• Backups you have restored once. A backup you have never tested may not work on the day.
• A record of changes. An activity log that shows who changed what makes a problem easier to spot and to undo.
• A host that updates PHP. Ask which version your site runs, and who updates it.

A different approach makes sense when your site is a brochure or lead-generation site that does not need plugins and nobody wants to own the patching. Pre-built sites remove whole types of attack: no database to inject into, no plugins to exploit, and no PHP running when a page loads. They suit businesses that update content, not those running an online shop.

Unpress, a modern, secure CMS, is our version of this, built and hosted by us. It is not for every site: online stores and members' areas need other tools. How Unpress keeps a site secure says what it covers and what it leaves to you, and a side-by-side look at the secure options compares the main types. Our SEO work keeps your rankings safe if you move.