# WordPress® security in 2026: the numbers, in plain English

**Short version:** For years, most WordPress break-ins came through plugins. In 2026, three serious flaws hit **WordPress itself and PHP**, the parts every site runs. Each was attacked within hours or days. Meanwhile the number of plugin flaws kept climbing. Updates still matter, but the time you have to apply them has shrunk from weeks to hours.

- **3** critical flaws in WordPress core or PHP that needed no login, in about 14 weeks
- **11,334** new flaws found in WordPress plugins and themes in 2025, up 42%
- **46%** of those had no fix on the day they were made public
- **5 hours** median time from disclosure to mass attacks, for the most-attacked flaws

*Plugin numbers: [Patchstack, State of WordPress Security in 2026](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/) (2025 data).*

## Three flaws in 14 weeks

| When | Flaw | What it allowed | How fast attacks started |
|---|---|---|---|
| 17 July 2026 | **WP2Shell** (CVE-2026-63030 with CVE-2026-60137), in WordPress core | Strangers could take over a site without logging in | Within 1–3 days. Over 62,000 different internet addresses tried it in 15 days ([CrowdSec](https://www.crowdsec.net/vulntracking-report/cve-2026-63030-wordpress-wp2shell-active-exploitation)) |
| 22 September 2026 | **CVE-2026-87902**, in WordPress core | Reading files, and on some setups running code | Within hours. Over 30,000 addresses in five days ([CrowdSec](https://www.crowdsec.net/vulntracking-report/cve-2026-87902-wordpress-vulnerability)) |
| 21 October 2026 | **[PHP2Shell](https://wranglepress.com/learn/php2shell)** (CVE-2026-109618 and CVE-2026-109619), in PHP | Running code on the server with one request | Attempts seen four days *before* the fix ([Tenable](https://www.tenable.com/blog/php2shell-cve-2026-109618-cve-2026-109619-frequently-asked-questions-about-critical-php-remote)) |

WP2Shell and CVE-2026-87902 are both on the US government's list of flaws known to be used in real attacks (the [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)). As of 24 October 2026, PHP2Shell was not yet on it.

## Why the usual advice falls short

The usual advice is: keep everything updated, add a security plugin or firewall, and pick a good host. All three still help. But each one depends on someone else's timing.

- **Plugin updates** only help once a fix exists. Almost half of plugin flaws had none on day one.
- **Firewalls** guess which requests look like attacks. In Patchstack's tests, typical hosting defenses blocked only 12–26% of attacks on known WordPress flaws. Cloudflare called its own PHP2Shell rules a stopgap.
- **Your host** decides when PHP gets updated. A perfectly maintained WordPress site was still exposed to PHP2Shell until the host acted.
- **Old PHP** is common. About [34% of WordPress sites](https://wranglepress.com/learn/php-end-of-life) run a PHP version with no official fixes.

## A different approach: take PHP off the public internet

Most of a typical business website doesn't need to run code for each visitor. The pages are the same for everyone. If visitors get plain files instead, there's nothing for an attacker to run code on.

That's the idea behind a [static WordPress site](https://wranglepress.com/learn/static-wordpress): show visitors a static copy, and either keep WordPress private for editing or retire it. A WordPress you keep isn't flawless and still needs updates, but a new flaw becomes a chore for this week, not an emergency for the next five hours. A retired one needs nothing.

## Sources

- Patchstack, State of WordPress Security in 2026: [patchstack.com](https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/)
- CrowdSec reports on [WP2Shell](https://www.crowdsec.net/vulntracking-report/cve-2026-63030-wordpress-wp2shell-active-exploitation) and [CVE-2026-87902](https://www.crowdsec.net/vulntracking-report/cve-2026-87902-wordpress-vulnerability)
- PHP advisory, 21 October 2026: [php.net](https://www.php.net/archive/2026.php#2026-10-21-5)
- CISA Known Exploited Vulnerabilities catalog: [cisa.gov](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

---

Canonical page: https://wranglepress.com/learn/wordpress-security-2026 · Last updated 2026-10-24