These days, WordPress sites are typically not hacked by guessing passwords but by exploiting newly disclosed plugin flaws – automatically and at scale – within hours. According to Patchstack, for the most heavily targeted flaws the median time from disclosure to the first mass attack is just 5 hours — while most site owners update once a month. The gap between the two, the update window, is the most important battleground in WordPress security in 2026. The good news: the window can be closed, and you don’t need to be an IT specialist to do it.
How are WordPress sites hacked today?
Password attacks haven’t gone away — in 2024 Wordfence’s network blocked more than 55 billion password attacks — but a strong password and two-factor login make them relatively easy to defend against. What’s more, Wordfence’s annual report shows that password attacks fell while vulnerability exploitation grew: attackers have shifted their focus to exploiting published flaws immediately.
And they have everything they need. In 2025, 11,334 new vulnerabilities were found in the WordPress ecosystem — 42% more than a year earlier — and 91% of them were in plugins.
In 2025, more serious, high-risk vulnerabilities were found in the WordPress ecosystem than in the previous two years combined — the number of flaws that can be exploited at scale rose by 113% in a single year. (Source: Patchstack)
On the attacker’s side the process is fully automated: bots watch vulnerability databases, and as soon as a flaw becomes public they try it against every WordPress site reachable on the internet. It’s important to understand this: nobody singled out your site — they try everyone’s, including yours.
How quickly do attackers exploit a new flaw?
Faster than most site owners even hear about it. According to Patchstack’s report, for the most heavily targeted flaws the weighted median time from disclosure to the first mass exploitation is 5 hours — and the timeline only gets worse from there:
| Time after disclosure | Share of the most-targeted flaws already under active attack |
|---|---|
| Within 6 hours | 20% |
| Within 24 hours | 45% |
| Within 7 days | 70% |
*(Source: summary of Patchstack data, 2026)*
A recent example of what this means in practice: for the flaw in the Gravity SMTP mailing plugin, Wordfence blocked more than 17 million attack attempts, over 4 million of them on the peak day. We’ve covered whether you’re affected and exactly what to do in a separate article.
The update window: the danger zone between disclosure and your update
Let’s do the maths. Mass attacks start on average 5 hours after disclosure. When do you update? If it’s once a month, your window could be as long as 30 days — weeks of running with an open, well-known flaw, exactly the kind the bots are hunting for.
And there’s more bad news. First, 46% of flaws have no fix at all at the moment of disclosure — so updating immediately wouldn’t help. Second, attackers don’t forget old flaws either: of the ten most-attacked vulnerabilities in 2025, only four were from 2025; the rest were flaws known for years that still work on sites running outdated plugins (Patchstack).
What is virtual patching, and how does it close the window?
A virtual patch is a firewall rule that blocks requests exploiting a flaw before they reach the site. It doesn’t touch the plugin’s code: it filters out the attack traffic, so it protects you even if the developer’s fix is late — or never comes. It doesn’t remove the flaw itself, so it doesn’t replace updating, but it buys you safe time to do it.
This is needed because general, hosting-level protection is weak against WordPress-specific attacks.
In Patchstack’s test, the protection systems of the hosting providers examined blocked only 26% of attacks targeting WordPress vulnerabilities — the rest are only stopped by an application-level firewall that “understands” WordPress. (Source: Patchstack)
This set-up has proved itself with our clients too. On one site, the first attempts appeared in the firewall log a few hours after a plugin flaw was published — at that point no fix even existed for the plugin. The virtual patch stopped them, and we installed the update once the developer had released it. All the site owner saw was a notification, not a hacked online shop.
What does this mean for your site?
There are four steps worth introducing, in order of importance:
2. Reduce your attack surface: delete every plugin you don’t use, and choose well-maintained plugins in the first place — our article on choosing plugins can help.
3. Use a WordPress-specific firewall with virtual patching, because hosting protection on its own isn’t enough.
4. Keep an eye on your site: you can spot the 8 tell-tale signs of a hack yourself, without an IT specialist.
A strong password and two-factor login are still the essential baseline — they’re just no longer enough. Attackers aren’t knocking on your door: they’re looking for freshly published cracks in the wall.
Close the update window — we can help
In the WPShield package, exactly these two elements work together: ongoing update management and a WordPress-specific firewall with virtual patching, so your site isn’t left unprotected in the critical hours after a flaw is published.
If you’d like to know how big your update window is right now, ask for our free quick security check: in 15 minutes we’ll show you where you’re exposed and what to close first. This article is the final part of our three-part series — the first covers the Gravity SMTP flaw, the second choosing secure plugins.
Frequently asked questions
How are WordPress sites hacked today?
Mostly automatically: bots watch for newly published plugin flaws and, within hours, try to exploit them at scale on every site they can reach. Password attacks haven’t disappeared, but a good password and two-factor login keep them well at bay — the main risk today is the unpatched vulnerability.
How quickly do attackers exploit a new flaw?
According to Patchstack, for the most heavily targeted flaws the weighted median time from disclosure to the first mass exploitation is 5 hours, and nearly half of high-impact flaws are attacked within 24 hours. Within a week, 70% of the most-targeted flaws are under active exploitation.
What is virtual patching?
A firewall rule that blocks requests exploiting a vulnerability before they reach the site — so it protects you even when the developer’s fix isn’t ready yet. It doesn’t remove the flaw itself, so it doesn’t replace updating; it just buys you safe time to do it.
Is it enough to update once a month?
Not any more. With a monthly routine you typically run for weeks with publicly known flaws, while mass exploitation starts within hours of disclosure. Turn on automatic installation of security updates and add a WordPress-specific firewall capable of virtual patching.
