WordPress sites face 13,000 successful attacks daily. Each unmaintained installation becomes a statistical certainty for compromise.

The WordPress ecosystem now tracks 64,782 total vulnerabilities across core software, plugins, and themes. Security researchers discovered 7,966 new vulnerabilities in 2024 alone, marking a 34% increase from the previous year’s 5,943 discoveries.

These numbers represent actual websites, actual businesses, and actual financial losses averaging $4.88 million per data breach in 2024.

The Mathematics of Vulnerability Distribution

Plugins create 90% of WordPress security holes, themes contribute 6%, and WordPress core accounts for 4%. While this distribution should tell administrators where to focus their update priorities, many website administrators have disabled automatic updates entirely. They operate their sites knowing that 92% of successful attacks exploit outdated plugins.

The severity ratings paint a clear picture, showing that attackers now possess more sophisticated tools and methods than at any previous time. Here are the specifics: 

  • 8% of vulnerabilities carry Critical ratings between 9.0 and 10.0
  • 23% fall into the High category at 7.0 to 8.9
  • Medium-severity issues comprise 45% at 4.0 to 6.9
  • Low-risk vulnerabilities make up 24%
  • Critical vulnerabilities increased from 5% in 2020 to 8% in 2024

Attack Frequency and Financial Consequences

WordPress sites encounter malicious attacks every 22 minutes. With WordPress powering 43.4% of all websites globally, attackers have automated their targeting systems to scan for outdated installations continuously.

The financial damage follows predictable patterns. UK businesses spend an average of £25,700 cleaning up after breaches, which includes system restoration, hardware replacement, and security implementation costs. The UK Government’s Cyber Security Breaches Survey 2025 reports the average cost of disruptive breaches at £3,550, though this calculation excludes reputation damage and customer trust erosion.

A single week in August 2025 saw 169 new WordPress vulnerabilities emerge. Security teams patched 71 vulnerabilities, while 98 remained unpatched. The WordPress ecosystem monitors 112,272 plugins and 30,165 themes across 791 different core versions. Each component requires separate tracking and updating protocols.

Hidden Maintenance Liabilities in WordPress Infrastructure

WordPress installations accumulate technical debt through forgotten staging sites, development environments, and test installations that administrators often overlook during security audits. These orphaned installations receive no updates, creating entry points for attackers who scan for vulnerable WordPress fingerprints across subdomains and subdirectories.

The dangers of keeping unused WordPress sites extend beyond primary installations to include abandoned client projects, old backup copies stored in accessible directories, and duplicate sites created for testing purposes that remain connected to production databases.

Organizations frequently maintain multiple WordPress instances for different departments or campaigns that fall outside regular maintenance schedules once their initial purpose ends. 

Security researchers have documented cases in which attackers gained access via a five-year-old demo site, then pivoted to compromise the main corporate website on the same server. These dormant installations often retain administrative credentials, outdated plugin configurations, and database connections that can enable lateral movement once breached.

Current Attack Methods and Their Success Rates

Malware infections affect 72.7% of compromised sites. Unauthorized backdoor access appears in 69.6% of breach cases. Cross-Site Scripting vulnerabilities account for 53.3% of all security issues discovered. SQL injection attacks continue targeting database weaknesses. Cross-Site Request Forgery exploits user sessions. Phishing campaigns hit 85% of businesses.

Artificial intelligence has changed attack patterns. Hackers use AI to predict password patterns for brute force attacks. They rewrite malicious XSS payloads until security filters fail. Automated systems test SQL injection vectors against thousands of sites simultaneously. The 2023 security report from Kinsta found that 39.1% of hacked CMS websites were running outdated software at the time of infection.

Professional Assessment of Security Preparedness

The Melapress WordPress Security Survey for 2025 gathered responses from administrators, developers, and site owners, and this is what they found:

  • 96% reported experiencing at least one security incident
  • 64% suffered complete breaches 

These professionals rate their security concerns at 7.8 out of 10 on average, but one in four maintains a breach recovery plan. Only 26% view compliance as a primary concern. 

The disconnect between awareness and action appears throughout the data. Administrators know the risks. They see the statistics. They understand the consequences. Yet half refuse to enable automatic updates and instead manually check for updates sporadically or forget entirely. Each day without updates increases vulnerability exposure as new exploits enter circulation.

The Infrastructure Supporting Vulnerability Discovery

Major vulnerability databases track WordPress security issues, including:

  • WPScan: Monitors 64,782 or more vulnerabilities
  • Wordfence Threat Intelligence: Maintains separate tracking systems
  • The National Vulnerability Database (NVD) provides government-backed documentation. 

Among tracked vulnerabilities, 26,978 represent unique issues affecting distinct software components or versions, and this grows every year as cybersecurity researchers accelerate their discovery rates. It’s clear that there is growing attention from both white-hat researchers and criminal organizations. 

Once a vulnerability is discovered, it receives a Common Vulnerabilities and Exposures identifier, and then patches typically follow disclosure timelines. Sites running outdated versions accumulate these unpatched vulnerabilities like compound interest.

Practical Update Implementation

WordPress core updates install automatically for minor releases by default, while major version updates require manual approval or configuration changes. Plugin updates demand individual attention unless administrators enable automatic updates for each one, and theme updates follow a similar pattern. The complexity multiplies with each additional plugin or theme installed.

Aside from that, database structures change between versions. File permissions require adjustment, and plugin compatibility breaks occasionally. These technical challenges discourage regular updates, leading administrators to delay updates to avoid disrupting functionality. 

Each postponed update extends the window for exploitation, and the cycle continues until a data breach occurs.

Conclusion

WordPress security depends on consistent maintenance. The data shows 13,000 daily compromises, an average breach cost of $4.88 million, and 7,966 new vulnerabilities discovered in 2024. 

It’s worth noting that plugins account for 90% of security issues since many administrators disable automatic updates. These decisions lead to predictable outcomes — sites without current updates will face compromise. Therefore, regular updates remain the primary defense against these documented threats.