When a WordPress plugin vulnerability hits the news, check today whether you use that plugin and which version you have. If a fixed version is out, back up and update straight away. If there’s no fix yet, deactivate and remove the plugin or shield it with a firewall, then check the site for signs someone got in first.
Key takeaways
- Act within hours, not weeks. Heavily exploited WordPress flaws were mass-exploited within a median of 5 hours of disclosure in 2025.
- Compare your installed version with the “fixed in” version in the alert. If yours is lower, you’re exposed.
- Nearly half of new vulnerabilities had no fix when they were announced, so updating isn’t always an option.
- After any serious alert, check for new admin users and unfamiliar files, even once you’ve updated.
Why do plugin vulnerabilities matter so much?
Because plugins are where almost all WordPress security holes are found. Patchstack recorded 11,334 new WordPress vulnerabilities in 2025, up 42% on the year before. 91% were in plugins, 9% in themes and only 6 in WordPress core (Patchstack).
Two more figures from the same report explain the urgency. 46% of those vulnerabilities had no fix available when they were disclosed. And the heavily exploited ones were attacked at scale within a median of 5 hours. Attackers scan the whole internet for vulnerable versions, so a small site is found just as quickly as a big one.
What should I do when my plugin is in the news?
- Check whether you use it. In WordPress, open Plugins and search for the name. Include deactivated plugins: their files are still on the server and may still be reachable.
- Check your version. The Plugins screen shows the version under each plugin’s description. Compare it with the affected and “fixed in” versions in the alert or the vendor’s changelog.
- Back up, then update. Take a fresh backup of files and database, update the plugin and test your key pages, forms and checkout.
- If there’s no fix, remove the risk. Deactivate and delete the plugin if you can live without it for a while, or swap it for an alternative. If you can’t, a web application firewall that blocks this specific attack can protect the site until a fix is released.
- Look for signs of compromise. Check Users for administrators you don’t recognise, Plugins for anything unfamiliar, and the site itself for redirects or spam. A malware scan helps here.
How do I read a vulnerability alert?
Alerts from Patchstack, Wordfence and WPScan use similar terms. Patchstack’s public vulnerability database lists the affected plugin and versions, the type of flaw and a risk score. These are the parts that matter:
| Term | What it means for you |
|---|---|
| Affected versions, such as “<= 4.5.5” | Every version up to and including 4.5.5 is vulnerable |
| Fixed in / patched version | Update to this version or later |
| Unauthenticated | Anyone on the internet can try it. Treat as urgent |
| Subscriber+ or Contributor+ | The attacker needs an account at that level. Urgent if your site lets people register |
| CVSS score | Severity from 0 to 10. Scores of 9 or more are critical |
| No official patch | No fix exists yet. Remove the plugin or use a firewall |
Severity scores rate the flaw, not your risk. A “medium” flaw in a plugin every visitor touches, such as a contact form, can still be worth fixing the same day.
Should I just turn on automatic updates?
For most plugins, yes. Since WordPress 5.5 you can turn on auto-updates plugin by plugin from the Plugins screen. WordPress then checks twice a day and emails you after each attempt (WordPress.org).
Auto-updates have limits. Premium plugins often need a valid licence to update. An automatic update can still break a layout or a checkout, so someone needs to check the site afterwards. And auto-updates can’t help when no fix exists yet.
For a benchmark, ASD’s Essential Eight expects critical patches to online services within 48 hours at its first maturity level (ASD). Our guide to the essential eight for small business maps that to your website.
What if my site was hacked before I updated?
Updating closes the hole but doesn’t evict anyone already inside. Attackers often add a hidden admin user or a backdoor file so they can return. If you find signs of compromise, treat the site as hacked: clean it fully, change all passwords and check for data loss.
If the site holds customer details, think about privacy too. Businesses covered by the Notifiable Data Breaches scheme must assess a suspected breach within 30 days (OAIC). Our guide to a data breach for small business walks through the steps.
How do I stay ahead of the next alert?
- Keep fewer plugins. Every plugin is code someone has to watch. Delete what you don’t use.
- Prefer maintained plugins. Check the last update date and support forum before installing.
- Use a firewall. Good secure web hosting or a security service can block known attacks before a patch is applied.
- Have someone watching. Vulnerability alerts arrive daily. For the bigger picture, see small business cyber security in Australia.
Our website security monitoring scans your site daily for malware and known vulnerabilities. Under our website maintenance plans, high-risk security updates are applied weekly and everything else monthly, with backups first.
Frequently asked questions
Is a deactivated plugin still a security risk?
It can be. Deactivating stops WordPress loading the plugin, but its files stay on the server, and some flaws can be reached by requesting those files directly. If you don’t need a plugin, delete it rather than just deactivating it. You can always reinstall it later.
How do I know if a plugin I use has a vulnerability?
Security plugins and vulnerability databases such as Patchstack, Wordfence and WPScan publish alerts, and many will email you about plugins on your site. WordPress also shows available updates under Dashboard, then Updates. A maintenance provider can monitor this for you and act on high-risk alerts.
What if the plugin developer has abandoned it?
Replace it. A plugin that no longer gets updates will never get a fix for the next flaw. Patchstack’s 2025 report found 1,614 plugins and themes were removed from WordPress.org in 2024 for unpatched security issues. Look for a maintained alternative and test it on a staging copy first.
Should I update immediately, even if it might break something?
For a serious, actively exploited flaw, yes. A broken layout is easier to fix than a hacked site. Take a backup first so you can roll back, update, then check the pages that matter. For low-risk updates, waiting a few days for others to find bugs is reasonable.
Sources
- State of WordPress Security in 2026, Patchstack, accessed 13 November 2026
- Patchstack vulnerability database, Patchstack, accessed 13 November 2026
- Plugin and themes auto-updates, WordPress.org Documentation, updated January 2023
- Quick reference guide for responding to data breaches, OAIC
- Essential Eight maturity model, Australian Signals Directorate, November 2023
- State of WordPress Security in 2025, Patchstack