WordPress Plugin Security 2026: 6 Proven Steps from New Data

For years, advice on WordPress plugin security came down to one rule: keep everything updated. The newest industry data suggests that is no longer enough on its own. Plugin flaws are rising, many are made public before a fix exists, and attackers are quick to move.

This guide summarises what Patchstack’s State of WordPress Security in 2026 report found about WordPress plugin security, then turns it into six practical steps for store owners. Patchstack is a security vendor, so treat its recommendations as one view, but the vulnerability counts are useful context for any site owner.

What the report found

The Patchstack 2026 report, based on 2025 data, reports:

• 11,334 new vulnerabilities in the WordPress ecosystem, a 42% increase on 2024.
• 91% were in plugins and 9% in themes. Only six were in WordPress core, all low priority.
• Highly exploitable vulnerabilities rose 113% year over year.
• 46% had no patch when they were disclosed.
• Speed: the weighted median time to first exploit for heavily targeted flaws was five hours, and about half of high-impact vulnerabilities were exploited within 24 hours.
• Premium components made up 29% of valid reports, and 76% of those were exploitable.
• Hosting defences: in Patchstack’s tests, common host defences blocked 12% of WordPress-specific exploit attacks in the first test and 26% of total attacks in a second, larger one.

Broken access control was the most exploited category. The report also warns of attack spikes during the Q4 holiday season, when staffing is often reduced, which matters for any store heading into the sales period.

What the data means for WordPress plugin security

Three points stand out. First, WordPress core is rarely the problem, so the plugins you add are your real attack surface. Second, an update is not always available, so waiting for one is not a plan. Third, paid plugins are not automatically safer, and the report treats them as a higher risk worth closer scrutiny.

How to judge a plugin before you install it

Many WordPress plugin security problems start at the moment of installation. Before adding a plugin, spend five minutes on these checks:

• Last updated. A plugin untouched for a long time may be abandoned. Look for recent changelog entries.
• Support activity. Do the developers answer questions and security reports, or are threads ignored?
• Scope. Does it do one job? A plugin that adds twenty features adds twenty places for a flaw.
• Source. Download from the official directory or the vendor’s own site, never from a random download page.
• Alternatives. Could a small snippet or a built-in WordPress feature do the same job?

This is our practical checklist, not a guarantee. Even a well-run plugin can have a flaw, which is why the later steps in this guide, such as backups and monitoring, still apply.

Six steps to improve plugin security

Step 1: List every plugin and theme

Open Plugins > Installed Plugins and write down the name, version, vendor and last update date of each. Include must-use plugins and any code your developer added. You cannot protect what you have not listed.

Step 2: Remove what you do not use

Deactivated plugins can still be targeted if their files remain. Delete anything unused, and replace plugins that have not been updated in a long time with maintained alternatives.

Step 3: Update on a schedule, with staging

Apply updates weekly, and test critical ones on a staging copy first, especially checkout, payment and caching plugins. For urgent security releases, apply them as soon as you can after a quick test.

Step 4: Treat paid and abandoned plugins with extra care

Check where each paid plugin comes from, whether the vendor publishes security notes and how fast it responded to past issues. Be wary of cracked or “nulled” plugins, which are a common source of malware.

Step 5: Plan for flaws that have no patch

When a flaw is public and unpatched, you have three options: deactivate the plugin until a fix arrives, restrict the affected feature, or add a protection rule from a security service. Vendors including Patchstack sell such rules, so compare options and ask how quickly they are applied.

Step 6: Back up and monitor before the sales season

Take a fresh off-site backup before any big promotion, and watch for new admin users, changed files and unexpected scheduled tasks. Our guides to WordPress security best practices and the recent PHP vulnerability cover related server-level risks.

Why plugins are attacked in these ways

The report says broken access control was the most exploited category, and its list of the most exploited flaws of all time includes unauthenticated stored cross-site scripting, authorisation bypass, unauthenticated arbitrary file upload, privilege escalation, PHP object injection leading to remote code execution, unauthenticated plugin installation and local file inclusion. In plain terms, many serious flaws let a visitor do something only a logged-in admin should be able to do, such as upload a file, change settings or install code.

That is why a plugin that looks harmless, like a form, a slider or a popup, can still put the whole site at risk. The risk comes from what the plugin is allowed to do on your server, not from how important its feature seems.

A 30-minute emergency drill

Practise before you need it. Pick a non-critical plugin and time yourself:

1. Take a backup and note the version number.
2. Deactivate the plugin and check the front end, checkout and admin.
3. Check the site log or a malware scan for anything unexpected.
4. Reactivate it and confirm everything works.

If you cannot do this in half an hour, write down who can, and give them the access they need. When a flaw is public and unpatched, speed is the one thing you control.

What to do if you think a plugin is compromised

Signs include unknown admin users, redirects to unfamiliar sites, new files you did not upload, or a sudden slowdown. If you suspect a problem, act in this order:

1. Take a copy of the site and logs for evidence before changing anything.
2. Put the site into maintenance mode if customers could be affected.
3. Change passwords for WordPress admins, hosting, the database and your payment gateway, and rotate API keys.
4. Remove the suspect plugin, update everything else and scan files against clean copies.
5. Restore from a clean backup if you cannot be sure the site is clean.
6. Review how access happened, so the same weakness is not reopened.

If payments or personal data may be affected, speak to your hosting provider and your payment provider quickly. Practising the plan once, as in the drill above, makes a real incident much less stressful.

Securing the accounts around your plugins

WordPress plugin security is only part of the picture. The report’s emphasis on broken access control is a reminder that who can log in matters as much as what is installed. Review these basics at the same time as your plugin audit:

• Give each person their own account with the lowest role they need. Shop managers do not need administrator rights.
• Turn on two-factor authentication for every administrator and for hosting and domain accounts.
• Remove accounts of former staff and agencies the same day they leave.
• Use unique, long passwords stored in a password manager.
• Limit login attempts and consider restricting the admin area by IP address where practical.

These steps cost little and close the doors that attackers try first. They also make your plugin updates safer, because a compromised admin account can install anything, however well your plugins are maintained.

A quick plugin audit checklist

• Every plugin has an owner who can say why it is installed.
• No plugin is abandoned or from an unknown source.
• Updates are tested on staging before production.
• A recent off-site backup exists and a restore has been tested.
• Admin accounts use strong passwords and two-factor authentication.
• You know how to disable a plugin quickly in an emergency.

Where we can help

Our website maintenance team handles plugin audits, update testing and monitoring, and our WordPress development team can replace risky plugins with custom code when that makes sense.

Free, premium and custom plugins compared

No category of WordPress plugin is automatically safe, but each has different trade-offs:

• Free plugins from the official directory are widely used and reviewed, but quality varies and some are maintained by one person.
• Premium plugins often come with support and regular updates, but the report above suggests they deserve the same scrutiny, since many valid reports about them were exploitable.
• Custom code does exactly what you need and nothing more, which shrinks the attack surface, but it needs a developer who writes and maintains it carefully.

For core store functions, such as checkout and payments, choose well-maintained and well-known options and keep them updated. For one small feature, a short piece of custom code can be safer than a heavy plugin. We usually suggest fewer, better-maintained plugins over a long list.

Building a simple plugin policy for your team

Many WordPress plugin security problems come from people adding plugins on impulse. A one-page policy removes the guesswork. State who may install a plugin (one named person), what checks come first (last update, support activity, purpose), where plugins may be downloaded from, and how a plugin is retired when it is no longer needed.

Add a rule that every new plugin is first installed on staging and tested with checkout and login. Keep a shared sheet listing each plugin, its owner and the date of the last review. This is not bureaucracy for its own sake. It means that when a vulnerability is announced, you can answer the question “do we use that plugin?” in seconds and not hours.

Frequently Asked Questions