WordPress Plugin Security: The Vulnerabilities That Actually Get Exploited

WordPress core itself has a strong security track record. The actual risk sits almost entirely in the plugin ecosystem — 91% of WordPress vulnerability disclosures in 2025 were in plugins, not core, which means a hardened core install is not the same thing as a secure site.

Both figures come from 2026 WordPress security research aggregating vulnerability disclosure data. A five-hour window from public disclosure to active mass exploitation means patching on a normal maintenance schedule — weekly, even daily — isn't fast enough for the worst vulnerabilities.

• Automated vulnerability monitoring matters more than a manual update schedule, given the exploitation speed involved.
• Every installed plugin is attack surface — fewer, more carefully chosen plugins is a real security strategy, not just tidiness.
• A plugin that's popular isn't automatically safer — 2026 has seen a rise in supply-chain attacks where attackers compromise a legitimate, trusted plugin directly.

• WordPress Plugin Development Best Practices