State of WordPress Security in 2025  ## Metadata - Author: [[Patchstack]] - Full Title: State of WordPress Security in 2025 - Category: #articles - Document Note: --- tags: [#wordpress-security, #vulnerabilities, #plugin-security, #patchstack, #cyber-resilience] - #wordpress-security - #vulnerabilities - #plugin-security Author: Patchstack Security Team Source: Patchstack Whitepaper Reference: [State of WordPress Security In 2025](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/) date created: 2025-05-16 19:10 --- # Title: 🔐 State of WordPress Security In 2025 ## Table of Contents: - [📝 Summary](#📝-summary) - [📖 Main Content](#📖-main-content) - [🗒️ Notes](#🗒️-notes) - [📖 References](#📖-references) - [🗣️ Paraphrase](#🗣️-paraphrase) - [📰 Newsletter](#📰-newsletter) - [✅ Action Items](#✅-action-items) - [🧪 Hypotheses](#🧪-hypotheses) - [📊 Methodology](#📊-methodology) - [❓ Questions](#❓-questions) - [🔮 Future Research](#🔮-future-research) - [💡 Implications](#💡-implications) - [🧠 Learning Styles Assessment](#🧠-learning-styles-assessment) - [📊 Accessibility Assessment](#📊-accessibility-assessment) - [🌍 DEIB Assessment](#🌍-deib-assessment) - [✅ Logical Validity](#✅-logical-validity) - [🔍 DARVO Analysis](#🔍-darvo-analysis) - [🔍 SEO Evaluation](#🔍-seo-evaluation) - [🎯 Conclusion](#🎯-conclusion) --- ## 📝 Summary: The Patchstack "State of WordPress Security in 2025" whitepaper provides a comprehensive overview of the security landscape in the WordPress ecosystem, with a focus on the explosion of vulnerabilities in third-party plugins, the effectiveness (and limitations) of current security solutions, regulatory impacts (especially from the EU’s Cyber Resilience Act), and the growing risks posed by AI-generated code. The report emphasizes that plugin vulnerabilities and a lack of security processes remain the largest threat to WordPress users, and calls for the adoption of proactive security strategies, including vulnerability management, virtual patching, and compliance with new international regulations. --- ## 📖 Main Content: ### 🗒️ Notes #### [📊 WordPress Security by the Numbers](#wordPress-security-by-the-numbers) - 7,966 new vulnerabilities in 2024 (22 per day); 96% in plugins, 4% in themes, 7 in core (none high risk). - Patchstack coordinated disclosure of 52% of all new vulnerabilities. - **43% of vulnerabilities** require no authentication—meaning attackers can exploit without a login. - Cross-Site Scripting (XSS) remains the most common vulnerability. - 1,018 vulnerabilities found in plugins with 100,000+ installs; install count ≠ security. - 500,000+ WordPress sites were infected in 2024. #### [🔥 Most Actively Exploited Vulnerabilities](#most-actively-exploited-vulnerabilities) - Top targets: LiteSpeed Cache, WordPress Automatic Plugin, Startklar Elementor Addons, GiveWP Plugin. - Attacks: XSS, SQL injection, arbitrary file uploads, PHP object injection. - SEO Spam, malicious redirects, unwanted ads, and website defacements are the most frequent attack consequences. #### [⚠️ Shortcomings in Current Security Practices](#shortcomings-in-current-security-practices) - **Relying on updates is not enough**—33% of vulnerabilities are not fixed in time for public disclosure. - Abandoned plugins are a huge risk; many are never patched or flagged for removal. - Auto-updates are often disabled to avoid breaking sites, increasing exposure windows. - Generic WAFs and plugin-based malware scanners are **routinely bypassed** by modern malware. - Malware often disables or removes security plugins after infection. #### [🛡️ Vulnerability Management & Virtual Patching](#vulnerability-management-virtual-patching) - Proactive vulnerability management and virtual patching prevent nearly half of all WordPress malware infections. - Patchstack’s system automatically deploys virtual patches for >10,000 vulnerabilities, even those lacking official fixes. #### [🔗 The Risk of Abandoned Plugins](#risk-of-abandoned-plugins) - 1,614 plugins/themes were removed from the repository for unpatched issues in 2024. - 33% of vulnerabilities not fixed in time; users often remain exposed. - Low-quality vulnerability reports and bounty fatigue strain developer resources. #### [🌐 Community Security Efforts: Patchstack Alliance](#community-security-efforts-patchstack-alliance) - 4,853 valid vulnerability reports from 179 researchers in 2024—nearly double the prior year. - Patchstack paid record bug bounties; 1,614 abandoned plugins removed from the repo after reports. #### [🚦 2025 and Beyond: Regulatory and Ecosystem Changes](#2025-and-beyond-regulatory-and-ecosystem-changes) - The EU Cyber Resilience Act (CRA) is the “GDPR moment” for WordPress security. - Plugin authors and the Foundation will have new legal responsibilities by 2026 (e.g., vulnerability disclosure). - Recent governance disputes (Automattic vs WP Engine) shake trust in the ecosystem and repository, impacting supply chain security. #### [🤖 AI & WordPress Security](#ai-wordpress-security) - AI-generated code is already introducing new vulnerabilities in plugins. - AI will accelerate both vulnerability discovery and exploitation. - Patchstack is developing AI-powered scanning tools, but warns of same tech being used by attackers. #### [🔐 Supply Chain & Community Trust](#supply-chain-community-trust) - Community distrust toward WordPress.org updates is spurring new projects (repository mirrors, distributed packages, code-signing). - There’s an increasing demand for improved supply chain security and transparency. #### [💡 Key Takeaways](#key-takeaways) - Updating alone isn’t sufficient; proactive vulnerability management is essential. - Regulatory compliance (especially for EU users) will become mandatory. - Virtual patching, coordinated disclosure, and open community efforts are key to a sustainable, secure future for WordPress. --- ## 📖 References: - [Patchstack State of WordPress Security In 2025](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/) - [EU Cyber Resilience Act](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act) - [OWASP Foundation](https://owasp.org/) - [Sucuri Security Reports](https://sucuri.net) - [Wordfence Security Blog](https://www.wordfence.com/blog/) - [Patchstack Vulnerability Database](https://patchstack.com/database/) --- ## 🗣️ Paraphrase: 1. **Original:** "In 2024, 7,966 new vulnerabilities were found in the WordPress ecosystem, primarily in third-party plugins... 33% of vulnerabilities were not fixed in time for public disclosure. Many of the vulnerabilities were disclosed in abandoned plugins and will likely never receive a patch." **Paraphrased:** Throughout 2024, nearly 8,000 new vulnerabilities emerged in WordPress, overwhelmingly in plugins. One-third of these issues weren’t patched before becoming public, and many occurred in plugins that had been abandoned—leaving users at risk indefinitely. 2. **Original:** "It’s impossible to ignore AI. AI-powered tools are already actively used in the WordPress ecosystem, introducing new risks and opportunities. GenAI is a powerful new technology which makes building products easier but, exactly like humans, it can and will make mistakes." **Paraphrased:** AI has become deeply woven into the WordPress ecosystem, bringing both innovation and fresh hazards. Generative AI makes development simpler, but—just as with human coders—mistakes are inevitable and can expose sites to new threats. --- ## 📰 Newsletter: 🚨 **WordPress Security Trends for 2025!** The latest Patchstack whitepaper is out and it’s a must-read for anyone building or running WordPress sites! Spoiler: plugin vulnerabilities are rising fast, and abandoned plugins are now a top risk. The new EU Cyber Resilience Act will require disclosure and proactive security for all plugin authors serving EU users—big changes ahead! The report also spotlights the dangers of relying only on updates or generic malware scanners, and highlights the increasing role (and risk) of AI-generated code. Read the [full report here](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/) and brush up on security best practices. Don’t forget—virtual patching and responsible vulnerability management are the new must-haves for 2025! --- ## ✅ A - Summary: An open-source security whitepaper, covering the most important security-related challenges, trends and statistics in WordPress. - URL: https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/ 1. [WordPress security by the numbers](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-87-12562) 1. [43% of all vulnerabilities uncovered in 2024 required no authentication - at least for the attacker](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-1911-21068) 2. [Cross-Site Scripting (XSS) remains the most widespread vulnerability](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-1917-21068) 3. [Vulnerabilities in popular plugins](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-1923-21068) 4. [The most popular plugins with severe vulnerabilities](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-1930-21068) 5. [The most actively exploited new vulnerabilities](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-1936-21068) 2. [More than 500,000 websites infected in 2024](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-1546-21068) 1. [SEO Spam](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-2179-21068) 2. [Malicious Redirects](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-2173-21068) 3. [Unwanted Ads](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-2031-21068) 4. [Website Defacements](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-2036-21068) 3. [WordPress security needs new strategies](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-2156-21068) 1. [Relying on updates is not enough to be safe](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-2256-21068) 2. [Generic WAF solutions fail to address WordPress attacks](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-2163-21068) 3. [WordPress malware-scanning plugins get bypassed by malware](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-2165-21068) 4. [Vulnerability management & virtual patching is essential](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-2157-21068) 4. [Lack of security processes increases risk and exposure](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-1574-21068) 1. [The risk of abandoned plugins and lack of security procedures](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-2041-21068) 5. [The Patchstack Alliance’s impact](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-2204-21068) 6. [2025 and beyond](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-1950-21068) 1. [AI & WordPress Security](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-1964-21068) 2. [Regulations and supply chain security](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/#headline-1967-21068) In 2024 something happened that will fundamentally change the way open source software is built and maintained: on December 10th, the [European Union’s Cyber Resilience Act (CRA) came into force](https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act#:~:text=This%20will%20allow%20buyers%20to,apply%20from%2011%20December%202027.). Its adoption went relatively unnoticed in WordPress circles, but in time it will prove to be a “GDPR moment” for software developers. The first requirements of the CRA will apply already from 2026. By September 2026, open source developers — including plugin & theme authors — must have processes in place to notify authorities and users about actively exploited or severe vulnerabilities. In 2024, 7,966 new vulnerabilities were found in the WordPress ecosystem, primarily in third-party plugins. That’s a 34% increase over 2023. While the majority of vulnerabilities don’t pose an active risk, high priority vulnerabilities were also up 11% year on year. Perhaps the most surprising finding from 2024 is that more than half of the plugin developers to whom Patchstack reported a vulnerability did not patch the issue before official disclosure. This raises concerns about whether the WordPress ecosystem is ready for the CRA or other security regulations. 01 #### About Patchstack Patchstack is the world's #1 WordPress vulnerability intelligence provider. We help hosting companies and website developers find and mitigate vulnerabilities in WordPress core, themes and plugins. Our mission is to make the open web more secure. We’re a globally trusted security partner for many of the leading WordPress hosting companies. We provide a vulnerability management & mitigation solution to companies such as **GoDaddy**, **Hostinger**, **Cloudways** and many others. Patchstack is backed by hundreds of ethical hackers through a global community called Patchstack Alliance. They actively search for new security vulnerabilities and potential threats so that Patchstack can notify its users and partners. We also partner with over 600 software vendors such as Elementor, WProcket, Yith and others to secure their plugins and ensure they comply with the Cyber Resilience Act. Patchstack is a member of the Open-Source Security Foundation, is backed by the European Innovation Council, and in 2024 was invited to Google's AI for Cybersecurity startup program. [##### Fastest vulnerability mitigation in WordPress Protect your web applications against vulnerabilities in WordPress core, themes and plugins](https://app.patchstack.com/register/)[##### Public WordPress vulnerability database Check our public database to see if your favorite plugin has any vulnerabilities, and take action on the threats that actually matter](https://patchstack.com/database/)[##### Free vulnerability disclosure program for plugins Ensure compliance with the Cyber Resilience Act, and outsource vulnerability report validation & rewards](https://patchstack.com/for-plugins/)[##### Vulnerability protection for hosts Use Patchstack vulnerability API and virtual patching capabilities to deliver security at scale](https://patchstack.com/for-hosts/) 02 #### WordPress security by the numbers 7,966 new security vulnerabilities were found in the WordPress ecosystem in 2024. That’s about 22 new vulnerabilities per day. 96% of the vulnerabilities were uncovered in plugins, and 4% were found in themes. Only seven vulnerabilities were uncovered in WordPress core itself, but none of those were significant enough to pose a widespread threat. 22 New vulnerabilities are published daily in the WordPress ecosystem Patchstack was responsible for coordinating the disclosure of 52% of all new vulnerabilities in 2024, through the combined efforts of our internal research team and our Patchstack Alliance community. While the numbers of WPScan have significantly dropped year on year, we see an increase in the number of vulnerability disclosures coordinated by WordFence. ##### Patchstack disclosed 52% of all new vulnerabilities in 2024 Patchstack 4,166 (52.30%) Wordfence 3,138 (39.39%) WPScan 594 (7.46%) Other 68 (0.85%) [Download graph as image](https://patchstack.com/wp-content/uploads/2025/03/patchstack-disclosed-52-of-all-new-vulnerabilities-in-2024.png) ##### Patchstack disclosed the highest number of medium and high severity vulnerabilities Show: Low Medium High Data: breakdown of Patchstack Priority scores [Download graph as image](https://patchstack.com/wp-content/uploads/2025/03/patchstack-disclosed-the-highest-number-of-medium-and-high-severity-vulnerabilities.png) ##### 96% of the vulnerabilities were found in plugins Show: Low Medium High Data: breakdown of Patchstack Priority scores [Download graph as image](https://patchstack.com/wp-content/uploads/2025/03/96-of-the-vulnerabilities-were-found-in-plugins.png) ##### An increase in vulnerabilities requires better prioritisation As the number of vulnerabilities has increased it is more difficult to filter out what truly matters. Due to the specific characteristics of WordPress, the standard CVSS (Common Vulnerability Scoring System) scale rarely gives vulnerabilities a low severity. The majority of vulnerabilities receive a medium CVSS score, even when they require high user privileges and cannot be exploited in a real-life scenario. We also commonly see cases when such vulnerabilities receive high-severity CVSS scores. **This creates a problem: when everything is important, nothing is.** In 2023 we released the [Patchstack Priority scoring system](https://patchstack.com/articles/patchstack-introducing-patchstack-priority/) and predicted that the volume of uncovered vulnerabilities would grow significantly over time. We knew that continued reliance on the CVSS scoring system would lead to alert fatigue and people would miss important issues. ##### Patchstack Priority Score To create the Patchstack Priority scoring system, we analyzed all of the available historical data about vulnerabilities known to be exploited in the WordPress ecosystem. It takes into account the prerequisites, vulnerability type, exploitation complexity, active install counts, and more. Based on these markers, the system categorizes all security vulnerabilities into low, medium, and high priority. Out of the 7,966 vulnerabilities uncovered in 2024, **11.6% received a high Patchstack Priority score.** These vulnerabilities are expected to be exploited or are already known to be exploited. **18.8% received a medium score,** which means they could be exploited in more targeted attacks. 69.6% of the vulnerabilities received a low score which we consider unlikely to be exploited. ##### 30% of new vulnerabilities had significant risk of exploitation Show: Low Medium High Data: breakdown of Patchstack Priority scores [Download graph as image](https://patchstack.com/wp-content/uploads/2025/03/30-of-new-vulnerabilities-were-likely-to-be-exploited.png) When we look into how CVSS scores have been assigned for the same vulnerabilities, only 0.49% of vulnerabilities received low severity and 66.9% of vulnerabilities were assigned medium severity. A high or critical CVSS score was assigned to 36% of vulnerabilities. As we automatically deploy [virtual patching](https://patchstack.com/articles/virtual-patching/) rules to our customers for all medium and high-priority vulnerabilities and track the vulnerability exploitations in real-time, we’ve calculated that **Patchstack Priority helps our users cut noise by 69.5%.** ##### CVSS often assigns too high severity for low impact WordPress vulnerabilities Compare by CVSS Patchstack Priority Show: Low (CVSS 0.1-3.9) Medium (CVSS 4.0-6.9) High (CVSS 7.0-8.9) Critical (CVSS 9.0-10.0) [Download CVSS graph as image](https://patchstack.com/wp-content/uploads/2025/03/cvss-often-assigns-too-high-severity-for-low-impact-word-press-vulnerabilities.png) [Download Patchstack Priority graph as image](https://patchstack.com/wp-content/uploads/2025/03/patchstack-priority-assigns-low-severity-for-low-impact-word-press-vulnerabilities.png) ##### 43% of all vulnerabilities uncovered in 2024 required no authentication - at least for the attacker 43% of new vulnerabilities found in 2024 did not require any authentication to be exploited. While vulnerabilities with an unauthenticated prerequisite tend to be easier to exploit, it’s not always the case. For example, a CSRF (Cross-Site Request Forgery) vulnerability is exploited by tricking the user into clicking a link or visiting a malicious page that will then execute a certain action under their own session. This happens when a nonce token is not being checked in the request. These results skew the unauthenticated related severity results as vulnerabilities are judged from the perspective of the attacker. Since the attacker does not need authentication in order to exploit a CSRF vulnerability, it is rated as unauthenticated by nature. ##### Vulnerabilities by prerequisite Show: Low Medium High Data: breakdown of Patchstack Priority scores [Download graph as image](https://patchstack.com/wp-content/uploads/2025/03/vulnerabilities-by-prerequisite.png) ##### Cross-Site Scripting (XSS) remains the most widespread vulnerability Cross-site scripting (XSS) could allow a bad actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads, into your website. These are executed when guests visit your site or on specific pages on the administration interface for authenticated users. XSS is a relatively easy security bug to find, and one security researchers often look for. It’s not surprising that in 2024 it was also the most commonly reported vulnerability type, making up almost half of all the new entries. Due to its potential severity (especially in the case of unauthenticated site-wide stored XSS), Patchstack often incentivizes researchers to find that particular vulnerability, contributing to its “popularity”. ##### Most commonly reported vulnerabilities Show: Low Medium High Data: breakdown of Patchstack Priority scores [Download graph as image](https://patchstack.com/wp-content/uploads/2025/03/most-commonly-reported-vulnerabilities.png) ##### Vulnerabilities in popular plugins There’s a security myth in WordPress that using popular and trusted plugins guarantees security. Software development is hard and security bugs happen everywhere. In addition, not all teams have dedicated security processes in place and some popular plugins don’t have much of a team at all. 1,018 Vulnerabilities affected plugins with at least 100,000 installs 1,018 vulnerabilities were found last year in components with at least 100,000 installs - of these, 153 received a High or Medium Patchstack Priority score. This demonstrates that install count is not a good indicator of security. If anything, a high install count makes plugins attractive targets for attackers. ##### Fewer vulnerabilities are found in popular plugins, but the potential impact is greater Show: Low Medium High Data: breakdown of Patchstack Priority scores [Download graph as image](https://patchstack.com/wp-content/uploads/2025/03/fewer-vulnerabilities-are-found-in-popular-plugins-but-the-potential-impact-is-greater.png) ##### The most popular plugins with severe vulnerabilities We looked at how many high-severity vulnerabilities were found in plugins with at least 100,000 installs to find the most impactful ones from 2024. Last year’s charts were heavily dominated by LiteSpeed Cache. Patchstack paid out the largest bounty in Patchstack history for a single vulnerability: $16,400 for the Privilege Escalation vulnerability in LiteSpeed Cache. This prompted our researchers and the community to dig deeper into the plugin, and five high severity issues were found. This does not mean that LiteSpeed Cache is an insecure plugin. Instead, it’s a good example of how bug bounties can motivate researchers to spend time digging out security issues that might otherwise remain hidden from everyone except bad actors. ##### Most popular plugins with severe vulnerabilities [Download table as image](https://patchstack.com/wp-content/uploads/2025/03/most-popular-plugins-with-severe-vulnerabilities.png) ##### The most actively exploited new vulnerabilities The following new vulnerabilities uncovered in 2024 have been most actively exploited based on our virtual patch hit data. [###### LiteSpeed Cache Plugin Affected versions: <= 5.7Cross Site Scripting (XSS)This vulnerability was discovered by Rafie Muhammad from the Patchstack team. It could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.](https://patchstack.com/database/wordpress/plugin/litespeed-cache/vulnerability/wordpress-litespeed-cache-plugin-5-7-unauthenticated-site-wide-stored-xss-vulnerability)[###### WordPress Automatic Plugin Affected versions: <= 3.92.0SQL InjectionThis could allow a malicious actor to directly interact with your database, including but not limited to stealing information.](https://patchstack.com/database/wordpress/plugin/wp-automatic/vulnerability/wordpress-automatic-plugin-3-92-0-unauthenticated-arbitrary-sql-execution-vulnerability)[###### Startklar Elementor Addons Plugin Affected versions: <= 1.7.13Arbitrary File UploadThis could allow a malicious actor to upload any type of file to your website. This can include backdoors which are then executed to gain further access to your website.](https://patchstack.com/database/wordpress/plugin/startklar-elmentor-forms-extwidgets/vulnerability/wordpress-startklar-elementor-addons-plugin-1-7-13-unauthenticated-arbitrary-file-upload-vulnerability)[###### GiveWP Plugin Affected versions: <= 3.14.1PHP Object InjectionThis could allow a malicious actor to execute code injection, SQL injection, path traversal, denial of service, and more if a proper POP chain is present.](https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-3-14-1-unauthenticated-php-object-injection-vulnerability)[###### GiveWP Plugin Affected versions: <= 3.16.3PHP Object InjectionThis could allow a malicious actor to execute code injection, SQL injection, path traversal, denial of service, and more if a proper POP chain is present.](https://patchstack.com/database/wordpress/plugin/give/vulnerability/wordpress-givewp-plugin-3-16-3-unauthenticated-php-object-injection-to-remote-code-execution-vulnerability) 03 #### More than 500,000 websites infected in 2024 Powered by [Sucuri](https://sucuri.net/) alone observed over 500,000 websites that became infected in 2024 - but this is just the tip of the iceberg. It’s impossible to see the full extent of the malware problem from the data of a single provider. Nevertheless, Sucuri’s data offers some insight into the most common malware types. WordPress core, plugin and theme vulnerabilities are to blame for [almost half of the malware infections](https://wewatchyourwebsite.com/the-real-attack-vector-responsible-for-60-of-hacked-wordpress-sites-in-2023/). Rest is related to poor security hygiene that enables hackers to hijack sessions from infected devices or use leaked usernames and passwords to get admin access. Looking at the data it is important to understand that while vulnerabilities remain one of the biggest threats in the WordPress ecosystem, users need to adopt [a multi-layered approach to security.](https://patchstack.com/articles/cheese-cake-and-cybersecurity-protecting-your-wordpress-website/) This involves having appropriate tools to manage threats on the application, network and server levels. Users also need better security hygiene – strong unique passwords, 2 factor-authentication and thoughtful access management should be as elementary as brushing your teeth. ##### SEO Spam This form of malware involves manipulating search engine optimization (SEO) techniques to fraudulently boost the visibility of certain content, often redirecting legitimate traffic to malicious or irrelevant sites. Sucuri’s data indicates a total of 422,466 incidents related to SEO spam, showcasing the varied methods employed to exploit search engine algorithms. **Japanese SEO Spam** emerged as the most prevalent, accounting for 27.77% of incidents. This tactic involves injecting Japanese text and links into vulnerable websites, often to promote counterfeit goods or phishing sites.  ##### Malicious Redirects These redirects covertly reroute users from their intended destinations to harmful or deceptive sites, often exploiting vulnerabilities in website code or configurations. There were 175,520 incidents involving malicious redirects, with a variety of tactics employed to mislead and exploit users. **Bogus URL Shorteners** accounted for 20.38% of incidents, using misleading short links to guide users to malicious sites. These shorteners disguise harmful destinations under the guise of legitimate URLs, making them particularly deceptive.  ##### Unwanted Ads According to Sucuri, a total of 16,274 incidents were linked to unwanted ads, with a diverse range of tactics employed by attackers. **ProPush** emerged as the most prevalent threat, accounting for 48.11% of all unwanted ad incidents. This tactic often involves tricking users into subscribing to push notifications that lead to spammy or harmful sites.  ##### Website Defacements These attacks involve unauthorized modifications to a website's appearance or content, often to display messages, images, or propaganda chosen by the bad actor. Sucuri’s analysis detected a total of 8,452 defacement incidents. **Generic Defacements accounted for 88.89%** of these incidents. These attacks typically involve altering the homepage or other visible areas of a site.  04 #### WordPress security needs new strategies ##### Relying on updates is not enough to be safe We commonly see people give the advice that to keep your website secure all you need to do is update plugins. While only using necessary plugins and enabling auto-updates may indeed keep you out of trouble for a while, the data shows that it’s not enough. 33% of vulnerabilities were not fixed in time for public disclosure In 2024, 33% of vulnerabilities were not fixed in time for public disclosure. Many of the vulnerabilities were disclosed in abandoned plugins and will likely never receive a patch. Most of them still have active installations; these insecure plugins remain installed and active across the web. It’s also common that the auto updates are turned off as website developers want to ensure that the new releases don’t include any breaking changes. That immediately increases the risk factor as it’s common for vulnerabilities to become exploited in a matter of hours after public disclosure. This happened in early 2024 with a [Remote Code Execution vulnerability found in Bricks Builder](https://patchstack.com/articles/critical-rce-patched-in-bricks-builder-theme/). ##### Generic WAF solutions fail to address WordPress attacks A security researcher from the Patchstack Alliance reported a vulnerability in Bricks Builder. We coordinated the disclosure with the Bricks Builder team and deployed virtual patching rules to our affected customers’ websites before the vulnerability was made public. A few hours after the vulnerability was disclosed, multiple IP addresses ran scripted mass exploitation campaigns to gain access to vulnerable websites and plant malware. Patchstack customers received automatic protection from the exploitation but as we monitored the attacks across our network we received reports that **all of the popular WAF solutions used by hosting companies failed to prevent the Bricks attacks.** This was caused by the lack of threat intelligence and visibility into the WordPress applications and sessions. Generic WAF solutions deployed via DNS/CDN (e.g. network-level firewalls such as Cloudflare) don’t have visibility into the application components, which plugins are installed, which users are authenticated and what kind of authorization they have. Similar limitations are present in server-level WAF solutions such as ModSec. With server access, you can deploy custom rules based on installed plugin versions, but accuracy is limited due to an inability to see into WordPress sessions, which in the case of the aforementioned Remote Code Execution (RCE) vulnerability in Bricks Builder caused severe false-positives. Most solutions rely on generic pattern-based rulesets, which are optimized to balance effectiveness with the number of false positives. This means that many WordPress-specific vulnerabilities go undetected as the providers don’t focus on WordPress, don’t keep up with WordPress threat intelligence, and therefore lack the technical capability to deploy vulnerability-specific rules. ##### WordPress malware-scanning plugins get bypassed by malware When attackers successfully exploit a website they try to make sure they are not kicked out. Hackers often hide malware inside the compromised website so they can later use it to launch attacks on other websites as part of a botnet. It’s widely known that popular security plugins used for malware scanning are disabled, bypassed and even completely removed by malware. In 2023, the security company [WeWatchYourWebsite](https://wewatchyourwebsite.com/how-we-identified-nearly-150k-hacked-wordpress-sites-in-60-days) identified 58,848 malware-infected WordPress websites that had WordFence installed prior to infection and in 14% of the cases malware tampered with the WordFence files to stay hidden. The same happens with other popular plugins that provide malware scanning capabilities; this has become more common in 2024. [This type of malware](https://gist.github.com/lynt-smitka/1eef476aed934fd3bc0be0813ea82f39) is now common and was used, for example, in the Bricks Builder RCE vulnerability attacks mentioned above. We actively discourage the use of any plugin-based malware scanners and recommend selecting a hosting provider who runs malware scans on a deeper level as part of their service. ##### Vulnerability management & virtual patching is essential Not only is vulnerability management, mitigation and reporting (like SBOMs) required by different existing and upcoming regulations - it has also proven to be the most effective way to prevent nearly half of the malware infections that affect WordPress websites. What we need is a combination of deep understanding of emerging threats, and an ability to act on them before hackers do. This is where Patchstack really excels. As the leading threat intelligence provider for the WordPress ecosystem, and having a complete visibility into the WordPress application (including sessions), we can automatically and precisely deploy the correct virtual patching rules to mitigate the vulnerabilities present on the website - including the 33% of which don’t have official patches available. All of that without any changes to code, performance disruption or false-positives. To date Patchstack has virtual patches for more than 10,000 vulnerabilities, and we’re making new ones available every day. This is by far, the largest and most complete collection of any kind of WordPress specific security rules available on the market. 05 #### Lack of security processes increases risk and exposure ##### The risk of abandoned plugins and lack of security procedures Unpatched and abandoned plugins have become a more significant security risk in WordPress. Abandoned plugins are not flagged for users even when they are removed from the [WordPress.org](http://WordPress.org) repository for security reasons. This leaves many users unwittingly exposed ([an issue we have raised since 2023](https://wordpress.tv/2023/09/30/state-of-wordpress-security-insights-from-2022/)). Last year, a total of 1,614 plugins and themes were removed from the WordPress repository for unpatched security issues. Of these, the vast majority (1,450) had High and Medium priority vulnerabilities: ##### 33% of vulnerabilities were not fixed in time for public disclosure [](https://patchstack.com/wp-content/uploads/2025/03/[email protected]) [Download flowchart as image](https://patchstack.com/wp-content/uploads/2025/03/33-of-vulnerabilities-were-not-fixed-in-time-for-public-disclosure.png) The flowchart highlights another problem: low quality reports of vulnerabilities that pose no real threat. In 2024, Patchstack has helped plugin developers filter out more than 1500 of these kinds of reports. Our threat intelligence & vulnerability triage team is equipped for this kind of work, but it can be a significant undertaking for any plugin developer who does not have a dedicated security team. It is easy for plugin developers to get overwhelmed with vulnerability reports and, with beg bounties in the mix, real vulnerabilities can go unnoticed. To keep users protected and trust intact, it is crucial to filter out noise and reach to real vulnerabilities as fast as possible. To address this problem, in September 2024, with the support of the European Commission, Patchstack launched a free vulnerability disclosure platform (mVDP) to enable WordPress plugin developers to set up a streamlined and secure vulnerability reporting system and become compliant with the European Cyber Resilience Act. [##### Free security tooling for plugins Outsource your vulnerability management from start to finish & comply with the Cyber Resilience Act](https://patchstack.com/for-plugins/) 06 #### The Patchstack Alliance’s impact It takes a village to find vulnerabilities. In this section we’ll look in depth at the contributions made by the security researchers in our bug bounty program. In 2024, we received **4,853 valid vulnerability reports** from 179 security researchers, almost twice the number of reports received in 2023. 428 of those reports were for plugins in Patchstack’s mVDP. For these reports, security researchers earn higher rewards and Patchstack helps the plugin developer to quickly release a high-quality patch and coordinate the disclosure. 97% of the vulnerabilities were uncovered in plugins hosted by [WordPress.org](http://WordPress.org). Vulnerabilities were also reported in plugins exclusively hosted in Github and we received vulnerability reports for more than 100 WordPress products sold on the Envato marketplace. 1,614 Vulnerable plugins were removed from the WordPress repository The reports also led to the closure of a whopping 1,614 abandoned plugins. These were removed from the [WordPress.org](http://WordPress.org) repository after attempts to contact the respective developers to fix the security issues. In August 2024, we also set the record for the highest bounty ever paid in the WordPress ecosystem for a single vulnerability; [$16,400 for John Blackbourn](https://patchstack.com/articles/interview-with-john-blackbourn/)'s discovery of a critical zero-day privilege escalation vulnerability in the Litespeed Cache plugin. Later, in October we set another record during our special WordPress security cleanup event for the Cybersecurity Month, resulting in [1,000+ plugins temporarily removed from the repository](https://patchstack.com/articles/nearly-1000-plugins-closed-during-wordpress-security-cleanup/) due to unpatched security issues. Patchstack Alliance is an open community for everyone interested in open source security. Security researchers can participate in our ongoing bug bounty program in which rewards are paid for the discovery of new vulnerabilities that are then responsibly reported to the software developers. This helps make our ecosystem more secure. 07 #### 2025 and beyond The end of 2024 introduced a lot of uncertainty into the WordPress ecosystem. The dispute between Automattic and WP Engine became public in September 2024 and is having a profound effect on WordPress businesses and the community as a whole. Trust in [WordPress.org](http://WordPress.org) has been broken as project norms and implicit agreements have been undermined. WP Engine-hosted sites were disconnected from [WordPress.org](http://WordPress.org) updates, presenting a major security issue for all WP Engine customers as well as the company itself. Plugin developers became aware of the precarious standing of their plugins within the repository when WP Engine’s Advanced Custom Fields was replaced by [WordPress.org](http://WordPress.org)’s Secure Custom Fields, signaling that any plugin could be replaced by [WordPress.org](http://WordPress.org) at any time. Public criticism of these and other actions has led to prominent contributors being banned from [WordPress.org](http://WordPress.org) and from the Make WordPress Slack. Businesses have been rejected from WordCamps as sponsors, speakers, and as attendees. This has led to instability in the WordPress community and amongst its contributors. Many remain silent in order to keep jobs that rely on access to [WordPress.org](http://WordPress.org) or to ensure the plugins that power their small businesses remain hosted in the repository. Amongst those who are speaking up, the community is fragmenting with new initiatives such as unofficial WordPress conferences, repository mirrors and even forks. In 2025, security concerns within WordPress extend beyond code. Businesses that rely upon WordPress, along with many community members, see governance and instability within the community as one of the project’s main security issues. Organizations that prioritise security are concerned about the integrity of the supply chain controls that hold the keys to nearly half of the global web. CRA Cyber Resilience Act will be the "GDPR moment" for plugin developers Meanwhile, the full implementation of the Cyber Resilience Act (CRA) is coming upon us fast. This change is coming and cannot be ignored. The WordPress Foundation is considered a software steward by the CRA and that comes with requirements on both governance and security. The same applies to software companies who build WordPress plugins. As long as they have users in the EU, they will be considered a manufacturer under the CRA and must follow the security requirements set by the regulation. This starts with vulnerability disclosure programs in 2026. ##### AI & WordPress Security It’s impossible to ignore AI. AI-powered tools are already actively used in the WordPress ecosystem, introducing new risks and opportunities. GenAI is a powerful new technology which makes building products easier but, exactly like humans, it can and will make mistakes. We predict four main areas where AI will have an impact on WordPress security: * AI-generated code will introduce new vulnerabilities * It will become easier to find new vulnerabilities * Vulnerabilities will become exploited faster * AI will make previously low priority vulnerabilities easier to exploit 2024 saw a significant uptick in AI generated code, particularly in plugins. We have uncovered security vulnerabilities in AI-generated plugins where the author was either not careful enough or who was too trusting of the code. With GenAI, shipping functional software does not require any coding experience. When the author lacks coding skills there is no one to validate the code quality and security before it is released to the public. AI can not only generate code, it can analyse it for specific use cases, such as finding security mistakes. The Patchstack AI/ML team has been working on an AI vulnerability scanner since 2023. In 2024, Patchstack was invited to the Google AI/Cybersecurity program where we received support to build a tool that is capable of generating deep understanding about the entire codebase and has independently discovered CVEs in popular WordPress plugins. While work to make this accessible to all plugin developers, we must accept the reality that it’s a matter of time until similar tools become accessible to cyber criminals as well. In addition to finding vulnerabilities, AI agents are capable of exploiting them. The most successful attacks happen when software does not yet have a patch for a vulnerability or when the majority of users are not yet up-to-date. Using AI to generate exploitation scripts can significantly reduce the time it takes to weaponise a vulnerability. After exploitation, AI is also an ideal tool to create polymorphic malware, which can stay undetected by most pattern based scanners. ##### Regulations and supply chain security The number of times regulations are mentioned in this whitepaper is a dead giveaway that we’re from Europe. Jokes aside, software security processes and supply chain security is something WordPress ecosystem needs to pay attention to in 2025. At a minimum, everyone need to stay compliant with new regulations, but we hope that businesses and developers strive to take security seriously and be trustworthy in the eyes of users. The current community distrust towards [WordPress.org](http://WordPress.org) - the only mechanism to access WordPress core, plugin, and theme updates - has ignited projects which either provide a back-up as a mirror of the official WordPress plugin repository or allow updates to be pulled directly from Github if the plugin is hosted there (such as [git-updater](https://github.com/afragen/git-updater) that has now over 3.2K stars). There are also initiatives such as AspirePress which is working on a distributed package repository for WordPress with code signing and authenticity checking. Apart from regulations, there's a growing demand for improved supply chain security within the community. This signals that security won’t just be approached as a box-ticking exercise, but to actually improve the WordPress ecosystem for the better. ##### References <https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act><https://patchstack.com/articles/patchstack-introducing-patchstack-priority/><https://patchstack.com/articles/virtual-patching/><https://patchstack.com/database/><https://patchstack.com/articles/cheese-cake-and-cybersecurity-protecting-your-wordpress-website/><https://patchstack.com/articles/critical-rce-patched-in-bricks-builder-theme/><https://patchstack.com/articles/interview-with-john-blackbourn/><https://patchstack.com/articles/nearly-1000-plugins-closed-during-wordpress-security-cleanup/><https://wewatchyourwebsite.com/how-we-identified-nearly-150k-hacked-wordpress-sites-in-60-days><https://gist.github.com/lynt-smitka/1eef476aed934fd3bc0be0813ea82f39><https://sucuri.net><https://wordpress.tv/2023/09/30/state-of-wordpress-security-insights-from-2022/> [Automatic vulnerability protectionManage & mitigate vulnerabilities in your WordPress, Drupal & Joomla sites](https://patchstack.com/pricing/)[Patchstack API for hostsEasily mitigate vulnerabilities at scale with the fastest intel on the market](https://patchstack.com/for-hosts/)[Security communityJoin our Discord Community and get help, recommendations, and solutions for WordPress security from fellow community members.](https://discord.gg/rkE8yxtNmS), State of WordPress Security in 2025, Patchstack, 01jpdsr2jn7tgddyknj1nt2ny7.