You should update WordPress because most update notices carry a security fix, and the moment a fix is published, attackers know exactly what to look for. In 2025, researchers logged 11,334 new WordPress vulnerabilities, almost all in plugins, and the most targeted ones were attacked within hours. An ignored update notice is an open door with a sign on it.
Key takeaways
- Patchstack recorded 11,334 new WordPress vulnerabilities in 2025, up 42% on 2024. 91% were in plugins.
- Heavily targeted flaws were first attacked within a median of 5 hours of becoming known.
- Sucuri found 39.1% of hacked CMS sites were out of date when they were infected.
- Updates are essential but not enough on their own: 46% of flaws had no fix when they went public, so a firewall matters too.
What is an update notice actually telling you?
An update can include bug fixes, compatibility changes, new features and security patches. The security part is the one that matters most. When a developer patches a flaw, the fix and its details become public, often with a severity score and a description of what an attacker could do.
That’s useful for you and for attackers. Automated tools compare the published list of flaws with the plugin versions they find on sites. A site still running the old version is easy to find and easy to attack.
What do the security numbers show?
Patchstack’s annual report counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, a 42% jump on the year before. Of those, 1,966 were rated high severity, likely to be used in automated mass attacks (Patchstack).
Speed is the part that changes how you should think about updates. For the most heavily targeted flaws, the weighted median time to the first exploit was 5 hours. About half of high-impact flaws were attacked within 24 hours. Waiting until “next month” is often too late.
Out-of-date software shows up again and again in hacked sites. Sucuri’s research found 39.1% of content management systems were out of date at the point of infection (Sucuri). And Wordfence found just under one million infected WordPress sites during 2024 (Wordfence).
Why do plugin updates matter more than WordPress itself?
Because that’s where the flaws are. Patchstack found 91% of 2025’s vulnerabilities in plugins and 9% in themes, with only six low-priority reports in WordPress core.
WordPress core also looks after itself better. Since version 3.7, existing sites install minor core updates, including security releases, automatically by default. Plugins and themes don’t, except in special cases (WordPress Developer Resources). So the notices sitting in your dashboard are usually plugin and theme updates that nobody has applied.
Premium plugins deserve a special mention. Patchstack found 29% of valid reports came from premium or freemium components, and premium components had three times more known exploited vulnerabilities than free ones. A premium plugin with an expired licence often can’t update from the dashboard at all, so it quietly falls behind.
If attacks start within hours, are updates enough?
No, and Patchstack says so directly: when attackers use a flaw within hours, regular updates alone are “not a viable defence”. Almost half of 2025’s flaws had no fix from the developer when they were disclosed, so there was nothing to install.
That doesn’t make updates optional. It means they work best as one layer. Updates close known holes. A WordPress-aware firewall can block attacks on a flaw before the patch exists. Off-site backups give you a way back if both fail.
Why do business owners put off updates?
Usually because an update broke something once. It’s a fair worry. Page builders and online stores have many moving parts, and a clash can break a layout or a checkout. Our guide to an Elementor update that broke your site covers the most common case.
The answer isn’t to stop updating. It’s to update safely: take a backup first, test risky updates on a WordPress staging site, then check key pages afterwards. With website backups you can restore, a bad update becomes a short rollback, not a crisis.
What should I do with the next update notice?
- Read what it fixes. If the changelog mentions security, treat it as urgent.
- Back up first. Make sure you have a recent copy of files and database, stored off the server.
- Update one thing at a time. Then you know which update caused any problem.
- Check the site. Load the home page, a form and the checkout if you have one.
- Remove what you don’t use. A deactivated plugin still sits on the server, so delete it.
For a routine that fits your site, our guide on how often to update WordPress sets out a schedule. If you’d rather hand it over, we run safe, tested WordPress updates as part of our website maintenance plans.
Frequently asked questions
Is it safe to ignore WordPress updates if my site works fine?
No. A site can look perfect while running a plugin with a published flaw. Attackers scan for vulnerable versions automatically, so a working site with old plugins is still an easy target. Working fine today says nothing about next week.
Does WordPress update itself automatically?
Partly. Minor core releases, including security releases, install automatically by default. Plugins and themes don’t, unless you turn on auto-updates for them. Newer installs may also take major core updates automatically.
Can an update break my website?
Sometimes, especially on sites with page builders, online stores or many plugins. That’s why you back up first, update one item at a time and check key pages afterwards. Testing on a staging copy removes most of the risk.
Are premium plugins safer than free ones?
Not automatically. Patchstack found premium components had three times more known exploited vulnerabilities than free ones in 2025. Premium plugins also stop updating when the licence lapses, so keep licences current and track who holds them.
What if there’s no update for a known vulnerability?
Deactivate and remove the plugin if you can live without it, or replace it. If you can’t, a firewall with virtual patching can block attacks on that flaw until the developer releases a fix.
Sources
- State of WordPress Security in 2026, Patchstack
- 2023 Hacked Website and Malware Threat Report, Sucuri, June 2024
- 2024 Annual WordPress Security Report, Wordfence, April 2025
- Upgrading WordPress, WordPress Developer Resources