Almost nobody gets hacked because someone targeted them. The overwhelming majority of WordPress compromises are automated: a scanner finds a known flaw in a plugin you installed and forgot about, and a bot walks in. Understanding how WordPress sites get hacked matters because the defence is not mysterious, it is just unglamorous.
Here is what the 2026 data actually says about how WordPress sites get hacked, and what it means for a site you own.
The numbers
Patchstack’s State of WordPress Security in 2026 counted 11,334 new vulnerabilities disclosed across the WordPress ecosystem during 2025. That is the highest figure ever recorded and a 42% jump on the year before. High-severity flaws, the kind used in mass automated attacks, rose 113%.
The distribution is the part worth internalising:
- 91% of those vulnerabilities were in plugins
- 9% were in themes
- 6 were in WordPress core itself, all rated low priority
WordPress core is not your problem. It is well audited, it updates itself, and the security team is competent. Your problem is the twenty-odd third-party plugins sitting on top of it, written to wildly varying standards, some abandoned years ago by authors who moved on.
Two more numbers explain the urgency. The median time from public disclosure to mass exploitation is five hours. And 46% of vulnerabilities have no patch available at the moment they are disclosed. So for a meaningful share of flaws, there is a window where the attack is public and the fix is not.
If you are wondering whether your host covers this: Patchstack found hosting defences blocked only 26% of vulnerability attacks overall, and just 12% of known exploited ones.
How WordPress sites get hacked: the four real routes
1. A vulnerable plugin
This is the front door, and it is not close. Roughly 250 plugin vulnerabilities are disclosed every week, and a large share are exploitable without any login at all. The typical site runs twenty or more plugins, so the odds of carrying at least one vulnerable component at any given moment are uncomfortably high.
Patchstack singled out broken access control as the single most exploited vulnerability class in 2025. That means an endpoint that performs a privileged action without properly checking who is asking. It is hard for a firewall to catch, because the request looks like ordinary authenticated traffic.
A counterintuitive finding: paid plugins were not safer. 59% of premium component vulnerabilities were rated high priority, and there were 33 critical zero-days in premium components against 12 in free ones.
2. The login page
Credential stuffing runs constantly and at enormous scale. Wordfence has reported blocking over 100 billion credential attacks in a single year from more than 74 million distinct IP addresses. None of that is aimed at you specifically. It is a machine trying every leaked password against every WordPress login it can find.
An administrator account with a reused password and no second factor will eventually be found.
3. Software you stopped updating
Only four of the ten most-attacked vulnerabilities in 2025 were disclosed that year. The rest were older flaws still being fired at sites that never applied the patch. Attackers keep old exploits in rotation precisely because they keep working.
4. The supply chain
The nastiest category, because you did everything right. Malicious code is introduced into a legitimate plugin and arrives through the normal update channel. In one 2025 case a departing employee planted a hidden backdoor in a widely used page-builder addon that created a concealed admin account reachable through a specific URL parameter.
What attackers do once they are in
Site owners tend to imagine defacement. Real compromises are quieter, because quiet is more profitable. Sucuri’s remediation data across tens of thousands of cleanups found:
- Backdoors on around 60% of compromised sites, so access survives your password reset
- SEO spam on roughly half, injecting pharmaceutical or gambling content that only appears to search engines
- Malicious admin users in 55% of infected databases
The SEO spam variety is particularly cruel. Many redirect payloads fire only for visitors arriving from Google and stay dormant for anyone typing the address directly. You can visit your own site every day for a month and see nothing wrong while your search listings quietly fill with someone else’s pharmacy.
How to tell whether it has already happened
Compromises are usually found late. These are the signals owners actually notice, roughly in the order they appear:
- Search results for your brand showing pages or keywords you never wrote
- A sharp organic traffic drop with no algorithm update to blame. A Google blacklist warning typically costs 80% to 95% of organic traffic
- Visitors reporting redirects you cannot reproduce yourself
- Administrator accounts you do not recognise, or password resets nobody requested
- Files with recent modification dates in
wp-contentthat no deploy explains - Your host warning you about resource spikes, or your mail landing on blacklists
If more than one of those is true, treat it as a compromise until proven otherwise.
What actually reduces the risk
Once you know how WordPress sites get hacked, the defence stops being mysterious. Nothing below is clever, which is rather the point:
- Delete plugins you are not using. Deactivated is not removed, and a deactivated plugin’s files are still reachable. This is the single highest-value thing most sites can do.
- Turn on automatic updates for plugins. Given a five-hour median exploitation window, a monthly maintenance habit is not fast enough.
- Check whether each plugin is still maintained before you trust it. An abandoned plugin will never receive a patch, whatever it costs.
- Two-factor on every administrator account, and no shared logins.
- Keep real off-site backups and confirm you can restore one. A backup you have never tested is a theory.
- Do not run nulled themes or plugins. Sucuri found the most persistent backdoor class hiding in exactly those.
If you think you have been hit
Cleaning a compromised site is not the same job as hardening a healthy one. Backdoors are designed to survive the obvious fixes, so reinstalling WordPress and changing passwords usually accomplishes nothing. The work is finding every persistence mechanism before you close the original hole.
I build WordPress plugins for a living, which means I spend my days in the same code attackers read. If your site is behaving strangely, or you want someone to look before it does, book a block of priority support and I will work on it directly, or get in touch and describe what you are seeing.
No ticket tiers, no offshore script reading from a checklist. You get a written summary of what was found and what was changed.