What we saw in 2025
We pulled our incident data from the past 12 months and looked for patterns. Some confirmed what we expected. Others surprised us. All of them inform how we configure defenses for clients in 2026.
This is our annual State of WordPress Security report. It's based on real incidents we handled, not vendor marketing or speculation. Take it as field intelligence, not theory.
Trend 1 — AI-assisted credential attacks
The biggest shift in 2025 was the arrival of AI-augmented credential stuffing. Attackers now feed prior breach data through ML models that predict likely password variations for a target, rather than throwing a generic dictionary at every login form.
What changed in practice
- Successful brute-force attempts in 2025 used average 4.2 password attempts per account (down from 18 in 2023)
- Account takeover rate from leaked credentials rose 35% year-over-year
- Stuffing attacks now use residential proxies to bypass IP rate limiting, distributed across thousands of source IPs
Defense that worked
2FA. Period. Sites with 2FA mandatory across all administrator accounts saw zero successful credential-based compromises in our dataset. The handful that did succeed were on accounts where 2FA had been temporarily disabled "for testing."
Trend 2 — Supply chain compromises
In 2025, we tracked four distinct cases of legitimate WordPress plugins being compromised at the source — either through stolen developer credentials or maintainer takeover. The compromised plugin update was pushed via wp.org's normal update channel, infecting tens of thousands of sites before detection.
Notable examples (anonymized)
- A popular SEO plugin (1M+ active installs) shipped a malicious update that survived 4 days before removal
- A backup plugin's developer credentials were stolen; a malicious version was pushed for 18 hours
- A page builder add-on was sold to a new owner who immediately monetized through adware injection
Defense that worked
- Delayed update strategy (wait 7–14 days for community detection)
- File integrity monitoring catching unexpected changes in plugin files
- Patchstack and Wordfence intelligence subscriptions providing early warning
The cheap "auto-update everything" strategy backfires hard against supply chain attacks.
Trend 3 — Mass exploitation via plugin CVEs
When a new plugin vulnerability is disclosed, automated scanners hit the entire WordPress internet within 24 hours. We measured the lag between disclosure and active exploitation:
- 2023: average 3.4 days
- 2024: average 1.8 days
- 2025: average 0.6 days
In 2025, several high-impact CVEs went from disclosure to active mass exploitation in under 4 hours. If you patched within 8 hours of disclosure, you were probably fine. If you waited a week, you were probably compromised.
The 5 most exploited plugin CVEs of 2025 (categories, not specific plugins):
- Page builder authentication bypass (3 separate plugins affected)
- WooCommerce extension SQL injection
- Backup plugin file upload restriction bypass
- Forms plugin XSS leading to admin takeover
- SEO plugin REST API authorization gap
Defense that worked
- Same-day patching for security advisories
- WAF rules that block common exploitation patterns even before patching
- Removing plugins not actively used (every dormant plugin is risk surface)
Trend 4 — Hosting account compromise as initial vector
A meaningful 2025 shift: many breaches we forensically traced did not start in WordPress at all. They started in the hosting account control panel — cPanel, Plesk, or the hosting provider's portal.
Common patterns
- Hosting panel passwords reused across services and leaked in unrelated breaches
- Hosting providers' 2FA optional and not enabled by clients
- Customer support social engineering convincing reps to reset accounts
- Cross-account compromise on shared hosting via filesystem traversal
Once in the hosting panel, attackers have full file access, database access, and the ability to install backdoors that any WordPress security plugin can't see because the malicious code lives outside WordPress.
Defense that worked
- 2FA on the hosting account, not just WordPress
- Unique passwords for hosting accounts (NEVER reused)
- Avoid shared hosting for any business-critical site
- Monitor login events from the hosting panel
Trend 5 — Targeted attacks on high-value verticals
Generic spam-and-redirect attacks are commoditized. The interesting 2025 development was targeted attacks on specific verticals:
- WooCommerce stores: credit card skimming injected into checkout pages
- Membership sites: bulk subscriber data exfiltration for resale
- Healthcare/legal sites: ransomware threatening regulatory disclosure
- Cryptocurrency-related WordPress sites: wallet-replacement attacks
These attacks are slower, quieter, and more damaging than generic compromise. They often go undetected for weeks because they don't break the site visibly.
Defense that worked
- Monitoring of outbound data flows (large transfers trigger alerts)
- Database write monitoring (unexpected new admin users, table changes)
- Reading the checkout page HTML monthly to verify integrity (sounds basic — most sites don't do it)
What didn't work as well
Wordfence "premium scans" caught significantly less than its marketing claimed. In our incident data, Wordfence detected the malware in 41% of cases where it was the primary scanner. That's not nothing — but it's not "blocks all WordPress attacks."
Auto-update for "minor security patches" introduced its own incidents. Three sites we worked with had their checkout break because of a minor WooCommerce patch that fixed one CVE while breaking compatibility with a popular shipping plugin.
Cloudflare's free tier was inadequate for sites under sustained attack. Sites that upgraded to Pro saw dramatic improvement; sites on Free continued to get hit.
Defenses ranked by ROI for 2026
Based on what worked across our entire client base:
- 2FA mandatory across all admin and editor accounts — free, prevents most credential attacks
- Cloudflare Pro with WordPress managed rules — $20/month, blocks 60–80% of automated attacks before reaching origin
- File integrity monitoring with alerts — included free in many security plugins (Wordfence, MalCare)
- Off-server backup with monthly restore drill — $5/month + a few hours quarterly to verify
- Delayed update strategy (7–14 days for non-security updates) — free, requires discipline
- Hosting account 2FA + unique password — free, often skipped
- WAF custom rules for known exploitation patterns — included in Cloudflare Pro, configured manually
- Patchstack or Wordfence Intelligence subscription — $25/month, alerts you to plugin CVEs immediately
- Periodic plugin audit — quarterly, free, removes attack surface
- Staging environment for testing major changes — $20/month, prevents update-induced breaks
What to expect in 2026
Three predictions based on the trajectory of 2025:
More AI-generated phishing. Spear-phishing of WordPress administrators using AI to craft personalized messages will increase. Awareness training for admins will become as important as technical controls.
Supply chain regulation. WP.org's plugin review process will likely tighten, mandatory developer 2FA, code signing for popular plugins. This won't catch everything, but it raises the bar.
Faster exploitation cycles. The gap between CVE disclosure and active exploitation will shrink below 1 hour for the most common attack patterns. Same-day patching will become the standard, not the exception.
The 2026 baseline security posture
For any business-critical WordPress site, here's the minimum baseline we recommend:
- 2FA on every administrator and editor account (TOTP, not SMS)
- 2FA on the hosting account itself
- Cloudflare Pro with WordPress managed ruleset enabled
- File integrity monitoring with Slack alerts
- Daily off-site backups with monthly restore drills
- A staging environment for any update larger than a security patch
- Patchstack or equivalent CVE intelligence subscription
- Quarterly plugin audit (remove unused, update infrequently-maintained)
- Database access restricted to localhost or internal network only
- Audit log of admin actions retained for at least 90 days
Total operational cost: under $100/month for most sites. Total time investment: roughly 4 hours/month after initial setup.
This baseline is what we deploy for every managed client. We can verify a site against this baseline in 30 minutes. We can deploy the baseline in a day or two for a new client.
When to call a specialist
If your business depends on WordPress and you're below the baseline above, the gap is your exposure surface. Closing it methodically takes a couple of days with the right help.
Hacked website repair — for post-incident recovery and prevention setup. WordPress emergency support — when you're under active attack. Malware removal — with the closing-the-entry-point work that prevents recurrence.