# A Deactivated Plugin Still Carries Its CVEs and Autoloaded Bloat ## Claim Deactivating (or even deleting) a WordPress plugin does not automatically remove its risk: a deactivated plugin's code can still carry known vulnerabilities while it sits on disk, and its autoloaded database options routinely outlive deletion entirely, loading on every page request until someone deliberately cleans them up. ## Evidence Matt Dorman's plugin-audit case study found 20 of 100 audited plugins deactivated but still deployed on disk, and 62% (231 KB) of one site's autoloaded database options belonged to plugins that had already been deleted — pure dead weight loading on every page request with no plugin left to attribute it to. ## Scope & conditions - Holds whenever a plugin is deactivated or deleted through the normal WordPress admin flow without an explicit options-table cleanup step — the common case for manual site maintenance. - Breaks for plugins that register an uninstall hook that reliably purges their own options (`register_uninstall_hook` implemented correctly) — the claim is about the common failure mode, not a law of the platform. - Scope is bounded to WordPress specifically (autoload is a WP-options-table mechanism); the general pattern — "disabled" is not "removed" — likely generalizes to other plugin/extension ecosystems, but that's untested here. ## Links - [[3. Resources/Permanent Notes/Plugin Count Is Not a Performance Metric Work Volume Is]] — because contrasts: that note argues plugin *count* isn't the performance signal, per-plugin work is; this note shows a specific case where a plugin contributes to that per-request cost while being invisible to a naive "active plugins" count, since it may not even be installed anymore. - [[3. Resources/Permanent Notes/Audit Facts Are Automatable Replaceability Judgment Is Not]] — because evidence-for: this is the concrete finding that motivated one of the automatable audit axes (autoload scanning) in the companion note. <!-- atomicity: 1 idea ✓ --> - [[3. Resources/MOCs/WordPress Hosting Security Stack MOC]] — applies-in: Joins the plugin risk and site hardening cluster.