WordPress security statistics 2026.

Between July 2025 and June 2026, Wordfence added 8,881 new WordPress vulnerabilities to its database across four quarterly reports. That's about 24 new holes a day, almost all of them in plugins. Over the same twelve months Wordfence blocked 67.2 billion password attacks, or roughly 184 million a day.

If you run a WordPress site, those numbers land on you as update notices you didn't plan for, a plugin that went quiet two years ago and a login page that never stops getting hit. The usual advice, "keep everything updated", doesn't cover the case that matters most: Patchstack's State of WordPress Security in 2026 found that 46% of 2025's vulnerabilities had no fix at all when they went public.

Most WordPress security statistics that still rank in search date from 2016 and 2017. This page replaces them with 2024 to 2026 data from the original publishers. Cite freely with a link.

WordPress security statistics at a glance

How many WordPress vulnerabilities are found each year?

Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% rise on the 7,966 it counted in 2024. Wordfence published 8,881 between July 2025 and June 2026, and 8,223 in 2024, 68% more than in 2023.

Wordfence counts each CVE once and notes that other vendors may count each affected piece of software, so the two totals differ by design. The Q2 2026 dip in raw volume came with a rise in high-threat bugs.

We stopped reading the raw vulnerability total as a risk score a while ago. The count rises mostly because more researchers are paid to look, through bug bounties and CVE programmes. The number that tracks real danger is the high-threat line, and that one rose in each of the last two quarters, from 131 to 182.

The next question is where those vulnerabilities live, and the answer hasn't changed in years.

Why are plugins the main source of WordPress vulnerabilities?

Plugins carried 91% of the new WordPress vulnerabilities found in 2025, themes 9%, and WordPress core just 6 low-priority issues, according to Patchstack. Core is small, reviewed and auto-updated; the plugin directory alone offers over 79,000 free plugins written by thousands of separate teams.

Paid plugins don't sit in the public directory, so fewer researchers read their code, and Patchstack found the bugs there are more often the dangerous kind.

Every plugin you install is code from a different team with a different release habit. If you audit a site, count plugins before you count vulnerabilities. Twenty plugins means twenty vendors you're trusting to patch on time, and the data below shows how often that trust fails.

That trust fails most visibly in the gap between disclosure and a fix.

How fast are WordPress vulnerabilities exploited, and how many go unpatched?

Heavily targeted WordPress vulnerabilities reached first exploitation in a weighted median of 5 hours in 2025, and 46% of all vulnerabilities had no fix when they were disclosed, according to Patchstack. Those two facts together mean that updating quickly isn't enough when there's nothing to update to.

Patchstack's 11,334 vulnerabilities times its 46% unfixed share gives about 5,200 known holes in 2025 that nobody could patch on disclosure day. Wordfence's quarter-end counts measure bugs still open months later, and their fall to 149 suggests vendors catch up eventually; the danger is the hours in between.

Five hours is shorter than most people's working day. We don't think any human update routine beats that, which is why virtual patching and firewall rules exist. The 12% figure for generic defenses is Patchstack testing its own category, so read it with that in mind, but the logic holds: generic rules don't know what a WordPress plugin endpoint looks like.

Some of those unfixed vulnerabilities never get a fix, because the plugin is closed instead.

What happens to plugins closed on WordPress.org for security issues?

WordPress.org removed 1,614 plugins and themes from its repository in 2024 for unpatched security issues, according to Patchstack, and 1,450 of them carried high or medium priority vulnerabilities. Closing a plugin stops new downloads; it does nothing to the copies already running on live sites.

In 2023, seven in ten plugins with a known unpatched hole were closed rather than fixed, and the dashboard on each affected site kept saying "up to date".

This is the part of WordPress security we'd fix first if we could. A closed plugin is a known vulnerability with a public write-up and no patch coming, and the site owner gets no warning. If you manage sites, check every plugin slug against its WordPress.org page once a quarter; a "closed" banner there is the only signal you'll get.

Closed plugins are one kind of stale code. Old WordPress and PHP versions are the other.

How many WordPress sites run outdated versions of WordPress and PHP?

About one in three WordPress sites reporting to WordPress.org (33.8%) is not on the current 7.1 branch, and 32.0% run a PHP version that no longer receives security fixes. Both shares come from WordPress.org's live version statistics, read on 14 November 2026.

WordPress.org counts only sites that check in for updates, so sites with update checks disabled, often the most neglected ones, are missing from these shares.

The WordPress number is better than its reputation; core auto-updates do their job for most sites. PHP is where the debt piles up. A third of sites on an end-of-life PHP version means a third of sites where the server itself stopped getting fixes, and no plugin setting changes that.

Old code invites attacks, and the attack data shows which doors get tried most.

Which attacks hit WordPress sites most often?

Password attacks are the most common attack on WordPress by volume: Wordfence blocked 67.2 billion of them from Q3 2025 to Q2 2026, against 38.3 billion firewall-blocked exploit requests in the same quarters. Among vulnerability types, cross-site scripting (XSS) leads the disclosure count and also led blocked exploit attempts in 2024.

Wordfence's 2024 report said password attacks were on the decline. Its next four quarters say otherwise: 67.2 billion blocked in the year to June 2026 against 55 billion in calendar 2024, from the same vendor and network. SQL injection is also climbing in the disclosure tables, from 107 published bugs in Q4 2025 to 213 in Q2 2026.

Brute force is the dull attack that never goes away, and the jump in unique IPs tells us bigger botnets are behind it. Two-factor login and a limit on login attempts still stop most of it. XSS dominates the disclosure count, but missing authorization and broken access control are what turn into real takeovers, so weigh the categories by impact rather than count.

When those attacks succeed, the result shows up in malware scans.

How many WordPress sites get infected with malware?

Wordfence detected malware on 573,000 of the sites it protects in Q2 2026, up 21.0% on the previous quarter. Sucuri's remote scanner found 1,176,701 infected sites across 70.8 million scans of all platforms in 2024, an infection rate of 1.66%.

Sucuri's 95.5% gets quoted as "95% of hacked sites are WordPress", but Sucuri's users are mostly WordPress sites to begin with.

The backdoor number is the one we'd put in front of anyone who thinks a cleanup ends when the visible spam is gone. Half of compromised sites had a way back in. SEO spam is also a reminder that most WordPress infections aren't after your data; they're after your domain's reputation, and that brings us to spam.

How much spam do WordPress sites receive?

Akismet, the anti-spam service for WordPress, shows a running total of 574 billion pieces of spam blocked on its homepage, read on 14 November 2026. Comment and contact form spam is the attack most WordPress sites meet every day, and it needs no vulnerability at all.

Nobody publishes an independent count of contact form spam per site, which is why we're planning our own study. The Akismet counter is cumulative since launch, so read it as scale, not as a yearly rate.

Spam is the WordPress threat with the lowest skill floor. A bot that finds a plain-text email address or an open form doesn't need a plugin bug. That's why we built Email Protector around hiding addresses from harvesters, and why we're working on contact form protection that doesn't make real people solve a CAPTCHA.

For the wider picture on forms, see our contact form spam statistics, and for who is sending all this traffic, our page on what percentage of internet traffic is bots. Every page in the series sits on the statistics hub.

How we calculated the original numbers

Four figures on this page do not appear in any source. Here is the arithmetic so you can check it.

1. 24 new WordPress vulnerabilities a day. Wordfence published 1,857 (Q3 2025), 2,213 (Q4 2025), 2,738 (Q1 2026) and 2,073 (Q2 2026) vulnerabilities. 1,857 + 2,213 + 2,738 + 2,073 = 8,881. 8,881 / 365 = 24.3. Patchstack's 2025 count gives about 31 a day (11,334 / 365), but Wordfence counts distinct CVEs and notes that other vendors may count each affected piece of software, so we used the more conservative Wordfence series.
2. 184 million password attacks a day. Wordfence blocked 19.2 + 13.8 + 16.0 + 18.2 = 67.2 billion brute force attacks over the same four quarters. 67.2 billion / 365 = 184 million. Against 38.3 billion firewall-blocked requests (9.7 + 9.1 + 9.1 + 10.4), that's 1.75 password attacks for every exploit request.
3. About 5,200 vulnerabilities with no fix at disclosure in 2025. Patchstack: 11,334 vulnerabilities x 46% not fixed by public disclosure = 5,214.
4. 33.8% of sites off the current branch, 32.0% on end-of-life PHP. WordPress.org's version API shows 66.135% on 7.1 and 0.042% on the 7.2 pre-release; 100 minus 66.135 minus 0.042 = 33.8%. Its PHP API shows 7.4 and older at 19.6% plus 8.0 at 3.3% and 8.1 at 9.0%, which sums to 32.0%. PHP 8.1 lost security support on 31 December 2025 (The PHP Group).

What the 2026 numbers say

The risk sits in the plugin list. Core produced six low-priority bugs in 2025; plugins produced over ten thousand. A security plan that stops before the plugin inventory is aimed at the wrong target.

Patching speed has a ceiling, and attackers are already under it. A five-hour median to first exploit and a 46% unfixed-at-disclosure share mean "update promptly" protects you from the slow half of the threat. The fast half needs firewall rules that know WordPress, fewer plugins, and someone watching for closed ones.

The boring attacks still win on volume. 184 million password attempts a day and a 574-billion spam counter aren't clever. They're cheap, which is why two-factor logins, rate limits and spam filters keep paying off.

FAQ

How many WordPress vulnerabilities were found in 2025?

11,334 new vulnerabilities were found in the WordPress ecosystem in 2025, according to Patchstack's State of WordPress Security in 2026, a 42% rise on 2024. Wordfence, which counts distinct CVEs, published 8,881 between July 2025 and June 2026, about 24 a day.

What percentage of WordPress vulnerabilities come from plugins?

91% of new WordPress vulnerabilities in 2025 were in plugins, according to Patchstack, with 9% in themes and only 6 in core. Wordfence put the plugin share at 96% for 2024, and WPScan's full database shows 93%.

How quickly are WordPress vulnerabilities exploited?

5 hours was the weighted median time to first exploit for heavily targeted WordPress vulnerabilities in 2025, according to Patchstack. About half of high-impact vulnerabilities were exploited within 24 hours, which is faster than most manual update routines.

Are closed WordPress plugins still dangerous?

1,614 plugins and themes were removed from WordPress.org in 2024 for unpatched security issues, Patchstack reports. Closing a plugin stops new downloads but leaves existing copies running, and WordPress does not warn the site owner. Remove any plugin whose WordPress.org page shows a closed notice.

How many WordPress sites run outdated PHP?

32.0% of sites reporting to WordPress.org run PHP 8.1 or older, all past end of life as of November 2026, by our sum of WordPress.org's version statistics. PHP 7.4 alone still runs on 14.3% of them, almost four years after its security support ended.

How many brute force attacks hit WordPress sites?

67.2 billion password attacks were blocked by Wordfence between July 2025 and June 2026, about 184 million a day. Unique attacking IPs reached 106.2 million in Q2 2026. Two-factor login and login rate limits blunt these attempts.

Sources

1. Patchstack, State of WordPress Security in 2026 (February 2026)
2. Patchstack, State of WordPress Security in 2025 (March 2025)
3. Patchstack, 2025 Mid-Year WordPress Vulnerability Report (July 2025)
4. Patchstack, The WordPress "Zombie" Plugins Pandemic Affects 1.6M+ Websites (August 2023)
5. Wordfence, 2024 Annual WordPress Security Report (April 2025)
6. Wordfence, Quarterly WordPress Threat Intelligence Report Q3 2025 (October 2025)
7. Wordfence, Quarterly WordPress Threat Intelligence Report Q4 2025 (February 2026)
8. Wordfence, Quarterly WordPress Threat Intelligence Report Q1 2026 (June 2026)
9. Wordfence, Quarterly WordPress Threat Intelligence Report Q2 2026 (September 2026)
10. WPScan, WordPress Vulnerability Statistics (November 2026)
11. W3Techs, Usage statistics and market share of WordPress (November 2026)
12. WordPress.org, Statistics (WordPress and PHP versions) (November 2026)
13. WordPress.org, Plugin Directory (November 2026)
14. WordPress.org, Security (2026)
15. WordPress.org Plugin Handbook, Alerts and Warnings (2026)
16. The PHP Group, Unsupported Branches (2026)
17. Sucuri, SiteCheck Malware Trends Report 2024 (2025)
18. Sucuri, 2023 Hacked Website & Malware Threat Report (2024)
19. Akismet, homepage spam counter (November 2026)
20. WordPress.org, Akismet Anti-spam plugin page (November 2026)
21. WordPress.org, Contact Form 7 plugin page (November 2026)
22. WordPress.org, Theme Directory (November 2026)

Methodology. Numbers were collected on 14 November 2026 and checked against the original publisher's page or dataset, not against other statistics roundups. Live counters (WordPress.org version shares, WPScan, Akismet, W3Techs, plugin install counts) were read on that date and will drift. Where vendors count differently (Wordfence counts distinct CVEs and notes that other vendors may count each affected piece of software), both are shown and labelled. Statistics older than 24 months are marked as dated in the text. Last updated 14 November 2026.