WordPress powers nearly half the web, which makes it the most targeted platform on the internet. In 2025 the threat landscape shifted in ways that left most conventional security strategies short: vulnerability counts climbed sharply, exploitation timelines collapsed to hours, and malware got better at surviving cleanup.
This overview uses 2025 security data to show WordPress and WooCommerce owners the real risks their sites face, and the practical steps that close the gaps.
How bad did WordPress vulnerabilities get in 2025?
11,334+42%
New vulnerabilities
Found across the WordPress ecosystem in 2025, up from the prior year.
4,124Needed action
Required mitigation
Serious enough to need active mitigation.
1,966High severity
Mass-exploit risk
More high-severity issues than the previous two years combined.
That isn’t a gradual trend. It’s a meaningful acceleration in attacker attention toward WordPress.
Where the vulnerabilities come from
Plugins91%
Of all newly reported vulnerabilities.
Themes9%
The remainder of new reports.
WordPress core6 issues
All low priority. Core isn’t the problem — the third-party layers on top of it are.
Are premium plugins actually safer?
No. Premium components are often the bigger blind spot. A focused look at premium marketplace components, including those sold through Envato, found:
- Nearly 2,000 valid reports for premium or freemium components — 29% of all reports.
- 76% of vulnerabilities in premium components were exploitable in real-world attacks.
- 3× more known exploited vulnerabilities than free components.
- 33 critical zero-days in premium components, versus 12 in free ones.
It isn’t that premium plugins are built more carelessly. Researchers have limited access to paid code, so fewer eyes review it. Lower scrutiny means lower awareness of risk, not lower risk.
How many were patched before disclosure?
Only 54%. The other 46% were made public before the developer shipped a fix, often handing attackers the details before site owners had anything to install. Plugin updates alone can’t be your security strategy when nearly half of disclosed flaws have no patch yet.
How fast attackers move after disclosure
Faster than most update schedules. For the most heavily targeted vulnerabilities, the weighted median time from disclosure to active exploitation was five hours, and about half of high-impact vulnerabilities were exploited within 24 hours — exactly when most admins either don’t know yet or haven’t patched.
What’s being exploited most
Broken access control topped 2025’s list. It’s hard to defend because the attacks look like normal logged-in behavior, with no obvious injection strings for a traditional firewall to catch. Other heavily exploited classes:
- Unauthenticated stored cross-site scripting
- Unauthenticated file upload
- Authorization bypass
- Privilege escalation
- PHP object injection
WooCommerce plugins made the top-ten targeted list, including a 2023 WooCommerce Payments privilege escalation still being hit on unpatched stores.
How well do standard hosting defenses hold up?
Not well enough. Penetration testing across hosting providers found standard setups, including internal WAFs and Cloudflare, blocked only 26% of WordPress exploit attempts — and just 12% against known exploited vulnerabilities. Generic WAF rules handle generic attacks reasonably well but miss the WordPress-specific classes behind most real exploitation.
What happens after a site is compromised
Why malware is harder to remove now
Attackers increasingly inject code into legitimate core, plugin, or theme files instead of dropping standalone malicious files. Because the base file is legitimate, deletion-based scanners flag it inconsistently or miss it — and deleting it breaks the site. Cleanup now means surgically removing the snippet from an otherwise valid file.
There’s a seasonal pattern
Malicious file uploads nearly tripled in November and December 2025. Q4 combines peak traffic with thin staffing, so attackers face less chance of fast detection. Stores running holiday promotions are in the year’s highest-risk window with the fewest people available to respond.
The malware families most active in 2025
Evasion patternTap to open
Selective content delivery
Campaigns like Japanese SEO spam, jgalls, and Parrot TDS show different content to different visitors: spam to search crawlers, phishing redirects to humans, clean pages to owners and scanners. Parrot TDS now also detects AI training crawlers. You often find out only when customers complain or organic traffic collapses.
Memory-resident persistence
Lock360 runs in server memory, not files. Clean index.php or .htaccess and the process writes the malicious code straight back. The cycle continues until the memory process is killed — something most standard scanners can’t do.
Uploader infrastructure
Uploader scripts nearly doubled in June 2025 and stayed high. They let attackers deploy new payloads at will, so a site cleaned of one infection can be reinfected through a dormant uploader that survived.
What the landscape looks like going into 2026
AI-assisted development is speeding up custom plugin production, with agencies generating functionality on demand and pairing AI-built React front ends with a WordPress backend. That stretches the attack surface beyond core, plugins, and themes into custom components, JavaScript packages, and PHP dependencies that standard WordPress scanners weren’t built to evaluate.
The same AI tools that build sites faster also help attackers find and exploit weaknesses on their own.
And the EU Cyber Resilience Act is pushing commercial plugin vendors to run formal vulnerability disclosure programs. Most don’t have the resources to handle high report volumes yet, which risks widening the gap between a flaw being found and a patch existing.
What store owners should do right now
The bottom line on WordPress security in 2026
The fundamentals haven’t changed: keep software current, limit plugin sprawl, and use strong credentials. What’s changed is that they aren’t enough on their own.
Exploits land within hours. Malware is built to survive standard cleanup. Premium plugins carry hidden risk. And AI-generated components keep widening the attack surface.
Effective security in 2026 means automated mitigation that activates in the first hours after disclosure, server-level detection that finds injected and memory-resident threats, and clear visibility into every component on the site. Treat security as a continuous process, not a cleanup after something goes wrong.
