Short answer: WordPress can be secure, but in 2026 the condition is different from a year ago - somebody has to update it within hours, not weeks. For years a convenient sentence was repeated: "the core is looked after, the risk sits in the plugins". This year both halves of that sentence took a beating.
What happened in 2026
June: six 9.8 vulnerabilities at once, 1.14 million installations
In June, six vulnerabilities rated CVSS 9.8 (the highest score seen in practice) were exploited simultaneously across popular plugins and one theme. 1.14 million installations in total:
| Plugin / theme | Installations | Scale of attacks |
|---|---|---|
| Breeze Cache (Cloudways) | 400,000+ | - |
| Kirki Customizer Framework | 500,000 (150,000 vulnerable) | - |
| Burst Statistics | 200,000 (115,000 vulnerable) | 7,400+ attacks a day |
| Everest Forms Pro | 4,000 | 29,300+ exploit attempts a day |
| WP Maps Pro | 15,800 | 3,600+ attacks a day |
| Motors (theme) | 22,000 | 23,000+ attempts since 7 June |
Note Everest Forms Pro: four thousand installations and almost thirty thousand attack attempts a day. Bots do not check whether you are a large company. They scan everything that answers on port 443.
July: wp2shell, a hole in WordPress itself
A month later something appeared that cannot be blamed on plugins. Two critical vulnerabilities in the WordPress core - CVE-2026-63030 (route confusion in the batch REST API endpoint) and CVE-2026-60137 (SQL injection in the author__not_in parameter) - chained together give remote code execution without logging in. Researchers named it wp2shell.
The key sentence from the analysis: the attack has no preconditions and can be carried out by an anonymous user against a clean WordPress installation, with no plugins at all. Versions from 6.8 upwards are vulnerable (SQL injection), and full code execution from 6.9 when persistent object caching is not running.
Once working exploit code was published, scanning started within hours: researchers recorded tens of thousands of attempts on honeypots, from addresses in seven countries.
How much time you really have
From Patchstack's annual WordPress security report (2025 data, published 2026):
- 11,334 new vulnerabilities in the ecosystem over the year - 42 per cent more than the year before,
- 91 per cent of them in plugins, 9 per cent in themes,
- median time from disclosure to the first exploit attempt: 5 hours,
- 46 per cent of the holes had no patch on the day they were published,
- the pace entering 2026: over 250 new plugin vulnerabilities a week.
Five hours. That is the window between "a vulnerability was announced" and "somebody is already trying it on your site". No company has someone sitting there waiting for those bulletins - and that is the heart of the problem, not WordPress itself.
Why this is not "WordPress's fault"
WordPress powers an enormous share of the internet, and that is precisely why it is target number one. The issue is an architecture born in a different era:
- The page is rebuilt from scratch on every visit. The server pulls text from the database, starts the theme and every plugin in turn - like cooking dinner from raw ingredients for each guest. The more add-ons, the more moving parts that can be broken.
- Every feature is someone else's code with full access. A form, a gallery, reviews, cookies, caching - a separate plugin from a different author, each with access to the database and the files. An average company site has between a dozen and twenty of them.
- Plugins get abandoned. The author stops developing it and it carries on sitting on thousands of sites. Your site gets no signal about it.
- Mess accumulates after several contractors. Modifications, workarounds, outdated plugins. The next person usually says it would be cheaper to build from scratch - and is usually right.
What to do today if you run WordPress
- Check your version and update the core. After July's vulnerabilities this is not a "later" task. Turn on automatic security updates.
- Remove plugins you do not use. An inactive plugin is still code on the server. The cheapest and most effective item on this list.
- Check the update dates of the ones that stay. A year without a new release is a warning sign; two years is a reason to replace it.
- Turn on two-factor login and delete the
adminaccount along with accounts belonging to former contractors. - Make a backup that lives off the server. A backup on the same hosting dies with the hosting, and a six-month-old backup is not a backup.
Not sure what is running inside your site? Write to me - I will go through the plugin list and tell you which ones have publicly known holes today. It takes me a quarter of an hour and I charge nothing for it.
How a NEO site differs
I will not claim that a NEO site cannot be hacked, because no such thing exists. I will describe how its attack surface differs:
- There is no plugin layer. Features are part of the engine. There are not twenty authors, any of whom can stop updating their piece.
- An update goes out once, to everyone. When a fix appears, I apply it on my side and it reaches every client at the same moment - no surcharges and no waiting for someone to click "update" in their panel. That is the answer to those five hours from the report.
- There is no login panel at the website's address. The panel is a separate application at a different address, so the bots hammering
/wp-login.phphave nothing to hit. - Fewer moving parts to begin with. The site renders at the network edge and reads data through an API instead of starting a dozen plugins on every visit.
And to be fair: a NEO site has a backend too. It renders in real time and reads a database. Anyone claiming "nothing runs on the server" either does not know how it works or is selling something else. Only a frozen, static copy of a site has no backend - and such a copy can be produced from NEO, should it ever be necessary to carry on without me.
When I build a client a WordPress site anyway
Because sometimes it is the right choice: a shop with hundreds of products and a wholesaler integration, a team used to the panel, a requirement for a specific industry plugin. Then I build the site on WordPress and say plainly what it costs to keep it in check: updates, backups, monitoring, reviews. I set this out at greater length in the advantages of WordPress.
A secure WordPress site is not a site that was built securely. It is a site that is maintained securely - every month, by a specific person.
Frequently asked questions
After the July 2026 vulnerabilities, can WordPress still be recommended? Yes, provided somebody keeps on top of updates. The core holes have been patched - the problem is installations nobody has updated.
Does anyone care about my small website? Bots do not choose. Everest Forms Pro had four thousand installations and recorded almost thirty thousand attack attempts a day.
How many plugins is too many? There is no threshold. The rule is: every plugin must have a reason, an active author, and somebody who checks its updates.
Does moving to better hosting solve the problem? No. Hosting can add a firewall, but a plugin vulnerability travels with the site. What does help is an up-to-date care plan and backups kept off the server.