Attackers need five hours to use a WordPress plugin flaw. How long does your site take to update?
Researchers logged 11,334 new security holes in WordPress sites last year, up 42%. For the ones attackers want most, the typical gap between the flaw going public and the first attack was five hours. Most small business sites get updated when someone remembers.
The numbers: A record year for WordPress holes
The figures come from Patchstack's State of WordPress Security in 2026 report. Of those 11,334 vulnerabilities, Patchstack rated 1,966 as high severity, the kind that gets used in automated attacks against thousands of sites at once. That high-risk group more than doubled in a year.
Patchstack puts the weighted median time to first exploit at five hours for the most heavily targeted flaws, and about half of high-impact flaws are attacked within 24 hours. Worse, 46% of the holes had no fix available on the day they were made public.
So even a site owner who updates every morning can lose that race.
The real problem: Plugins, not WordPress
WordPress itself is in good shape. Patchstack found just six vulnerabilities in core all year, none of them urgent. 91% were in plugins and the other 9% in themes.
The small business sites we look after often run 20 or more plugins, added over the years by different people for different jobs. Each one is code written by someone else, and each one needs updating. The contact form plugin someone installed in 2019 and forgot about is a far bigger risk than WordPress.
Paying for a plugin doesn't make it safer, either. Premium plugins had three times as many known exploited vulnerabilities as free ones. And "cracked" copies of premium plugins, downloaded free from dodgy sites, are a favourite way to hide malware.
What we found: 293 days inside a hotel's website
Last month we cleaned up a small hotel's WordPress site after its hosting company suspended it for malware. The way in wasn't a plugin flaw at all.
The attacker got in with a stolen admin password. Within three days they had installed a file manager plugin, added their own fake plugin as a backdoor, created two extra admin accounts, and switched off the site's security plugin. Then they settled in.
Over the next nine months the site picked up 231 casino spam pages, two plugins that showed search engines different content from real visitors, and a script that showed Windows visitors a fake "update your browser" download. That script ran for about 101 days. The site also had cracked copies of two premium plugins installed.
Nobody noticed any of it. The site looked normal to its owners the whole time. The only reason it came to light was the host's own malware scan, 293 days after the first break-in.
Passwords and plugins are different doors, but the failure was the same: nobody was watching.
The UK picture: Small firms are slipping on the basics
The government's Cyber Security Breaches Survey, published in April, found that 43% of UK businesses had a breach or attack in the past year. The more worrying finding is the trend for small firms (10 to 49 staff). Cyber risk assessments fell from 48% to 41%, and formal cyber security policies fell from 59% to 52%.
Fewer small businesses are checking their risks at the exact moment attacks are getting faster. For most of them, the website is the most exposed thing they own.
What to do: Close the gap this week
A small business can close most of this gap without a security team. It takes six habits and one person who owns them.
- Delete any plugin you aren't using. Deactivated plugins still sit on the server and can still be attacked.
- Turn on automatic updates for plugins, and make sure daily backups are running before you do.
- Never use cracked premium plugins. Buy the licence or replace the plugin.
- Give every admin a unique password and two-factor login, and remove admin accounts nobody uses.
- Add a firewall or security service that blocks new attacks before the plugin author ships a fix. Patchstack's testing found standard hosting defences stopped only 12% of WordPress-specific attacks.
- Once a month, check the list of admin users and plugins for anything you don't recognise.
If nobody in your business owns that list, give it to someone. That can be us.
The bottom line: WordPress is safe when someone is watching
We still build on WordPress, and the core software is solid. The risk lives in the plugins we pile on top and in sites that run for years with nobody checking.
A site that updates itself, runs a firewall and gets checked once a month is a far harder target than most.
Attackers go for the easy sites first, so make yours one of the hard ones.
Steve Lavine is a full-stack developer and founder of Lavine Web & AI Solutions, working with SMEs and startups across the UK. lavine.dev