Patching WordPress is not enough: 46% of new flaws had no fix at disclosure

For years, the standard advice for anyone running WordPress was simple: keep it updated. Patchstack's 2026 security whitepaper shows where that advice leaves a gap. The idea is easy to state. Updating only helps if a fix exists, and if you install it before attackers arrive.

What Patchstack counted

Patchstack is a WordPress security vendor. It says researchers found 11,334 new vulnerabilities across the WordPress ecosystem during 2025. That is 42% more than in 2024. Of those, 4,124 (36%) were serious enough that Patchstack wrote protection rules for them.

Within that group, 1,966 (17% of all new flaws) were rated high severity. Patchstack describes these as the kind of flaw attackers are likely to exploit at scale with automated tools.

The risk sits in add-ons, not in the core software. Patchstack says 91% of the new vulnerabilities were in plugins and 9% in themes. Only six were in WordPress core, all low priority.

WebPulse's NVD profile for WordPress shows the same shape. It lists 3 CVEs against WordPress in the last 12 months, 584 in total. The NVD profile is matched to the WordPress product, so it says little about plugin flaws, where Patchstack finds most of the risk. It does show that the core product is not where most of the news sits.

Why a plugin flaw is a whole-site problem

The author of a hatamoto.dev post explains the mechanism. He runs a web agency and now sells an alternative platform, so read his view as that of an interested party. His point is that plugins and core share one PHP process, the program that runs the site. Each plugin therefore gets the same reach into the database and files as core does. He argues that nothing asks a site owner for permission or restricts what a plugin may touch.

In plain terms, a slider plugin and a payment plugin share one room. A flaw in the first can reach what the second holds. That is why one plugin bug becomes a site-wide event.

Fixes arrive late, attacks arrive early

Patchstack found that 46% of vulnerabilities had no developer fix by the time they were made public. Its conclusion is that site owners cannot rely on plugin updates alone.

Speed is the second problem. About half of high-impact vulnerabilities were exploited within 24 hours, Patchstack says. Weighted by how intense the attacks were, the median time to first exploit was 5 hours. That figure covers the most heavily targeted flaws, not all of them.

Premium or freemium components, including those sold on marketplaces such as Envato, looked worse. Patchstack received 1,983 valid reports for premium or freemium components. It rated 59% of them high priority and 17% medium, so 76% were exploitable in real attacks. Premium components also had three times more known exploited vulnerabilities than free ones. Patchstack's Zero Day program found 33 highly critical vulnerabilities in premium components, against 12 in free ones. Patchstack says researchers find it harder to inspect their code.

The network layer did not catch much

Many organisations assume their host or a web application firewall covers the gap. Patchstack tested that in two 2025 pentests. Common defences, including internal firewalls and Cloudflare, blocked 12% of WordPress-specific attacks on known exploited flaws. In a wider test with more generic vulnerabilities, they blocked 26%.

Results varied by hosting company. Patchstack says this was likely due to how each firm configured its firewall. These were Patchstack's tests, and the firm sells a competing form of protection.

After a breach, cleanup gets harder

Patchstack's partner Monarx adds the post-breach view. It says the dominant malware families use cloaking: they show search engines spam and send human visitors to fraud sites. Site owners and scanners often see a clean page. Monarx says one variant, Parrot TDS, now detects AI training crawlers and serves them clean content.

Another family, Lock360, runs in server memory. It rewrites files such as index.php the moment someone restores them. Monarx also reports that malicious file uploads nearly tripled in November and December, when staffing is thin.

What the scan data adds

WordPress is a large part of the platform base this applies to. WebPulse's September 2026 scan of the Tranco top 10,000 domains detected a platform on 2,491 sites. WordPress accounted for 719 of them (28.9%). That is a share of detected sites in this sample, not of the whole web. The scan detects the platform, not whether a site runs vulnerable or unpatched plugins.

Questions to put to your team

Ask how long it takes from a vulnerability disclosure to a protection in place on your sites. Patchstack's argument is that the answer should be under five hours. Ask which plugins are premium and who reviews them. Ask whether your host has tested its firewall against real exploits, or only configured it.

Ask what happens if a plugin has no fix at all. Is there a plan to remove or replace it? Finally, ask whether your cleanup process finds malware that hides from scanners.

The lesson is that updating alone does not cover the gap. Defence means assuming the flaw may be public before the fix exists.

Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Patchstack.