Updating your plugins is not a WordPress security plan

There is a line in almost every WordPress security guide, usually near the top, usually in bold: keep your plugins updated. It is good advice. On its own it is no longer enough, and the data behind that claim has gotten hard to argue with.
Patchstack publishes an annual report on WordPress security. The 2026 edition, covering 2025 data, counted 11,334 new vulnerabilities across the WordPress ecosystem. That is a 42% rise on the year before. Of those, 1,966 carried a high severity score, which in Patchstack's classification means they were likely to get swept up in automated mass attacks. More high-severity vulnerabilities turned up in 2025 than in the previous two years put together. The raw count is not really the problem. The timing is.

 Five hours
Patchstack measured how long it takes a newly disclosed vulnerability to go from public knowledge to active exploitation. Roughly half of high-impact vulnerabilities were being exploited within 24 hours. When the measurement was weighted by how intense the exploitation actually was, the median dropped to five hours.
That is the window. Five hours between a vulnerability becoming public and bots working through every site running the affected version. Now think about how a real site gets updated. Maybe automatic updates are switched on, in which case the plugin author has to ship a patch first. Maybe updates run on a schedule, Monday mornings, whenever the retainer says. Maybe a freelancer logs in when the client emails about something else entirely. None of those rhythms fit inside five hours. And all of them assume a patch exists. Nearly half the time, there is no patch. This is the finding that should change how people think about the problem. Patchstack reports that 46% of vulnerabilities did not receive a fix from the developer in time for public disclosure.
Worth sitting with. A researcher finds the bug. The vendor gets told. The disclosure window runs out. The vulnerability goes public on schedule, and in nearly half of those cases the plugin is still broken on the day the world finds out about it.
If your defence is "update everything promptly," you are depending on a patch that about half the time is not there yet.

 Where the vulnerabilities actually are ?
Plugins accounted for 91% of new vulnerabilities in 2025. Themes made up 9%. WordPress core produced six, all rated low priority. So core is fine. Core has been fine for years. The risk lives in the things you chose to install.
There is a wrinkle here that cuts against what most people assume. Paid plugins are not safer. Patchstack ran focused research on premium marketplaces such as Envato and received 1,983 valid vulnerability reports for premium or freemium components, making up 29% of all reports. Of those, 76% were rated exploitable in real attacks. Premium components carried three times as many known exploited vulnerabilities as free ones. Patchstack's zero-day program found 33 highly critical issues in premium components against 12 in free ones. The explanation is not that commercial developers write worse code. It is that researchers cannot audit code they have to buy first. Less scrutiny produces fewer reports, not fewer bugs. A quiet vulnerability history on a paid plugin tells you less than you think.

 Your host is probably not covering this
Plenty of site owners assume the hosting company handles security. Patchstack tested that assumption twice during 2025, running pentests against the defences common at hosting providers, including internal web application firewalls and Cloudflare.
The first test focused on known exploited vulnerabilities. Those defences blocked 12% of WordPress-specific attacks. A second, broader test that included more generic vulnerability types pushed the figure to 26% Twenty-six percent. Keep that number in mind the next time a hosting sales page promises enterprise-grade protection. Block rates also varied a lot between providers running similar tooling, which suggests configuration matters more than the logo on the dashboard.
Part of the reason for the poor showing is the shape of the attacks. Broken access control was the most exploited category Patchstack blocked, and it is genuinely hard to filter, because the requests look like ordinary authenticated traffic. There is no injection payload to match against. Someone is simply doing a thing they should not be permitted to do, using a request that is otherwise well formed.

 What actually changes your risk ?
None of this makes the situation hopeless. It means the useful lever has moved somewhere else.
Cutting the plugin count is the cheapest thing available and almost nobody does it. Every plugin is code you did not write, running with full access to your database. Deleting the four nobody has opened in a year costs an afternoon and removes that code from the equation permanently. Deactivated is not deleted, incidentally. Files sitting on disk can still be reachable depending on how they were written.
Virtual patching is the category that exists precisely because of the five-hour problem. Services like Patchstack and Wordfence Premium push a rule that blocks exploitation of a specific vulnerability without waiting for the vendor's fix. Given that 46% of disclosures arrive unpatched, this closes a gap that plugin updates structurally cannot.
Restoring a backup matters more than taking one. The 2026 report, drawing on malware data from Monarx, notes that attackers increasingly inject malicious code into legitimate core, plugin and theme files rather than dropping obvious new ones, which makes clean removal harder and reinfection likelier. One malware family in the data runs from server memory and rewrites files like index.php the moment they are restored. A backup you have never tested is a hypothesis.
The calendar is worth watching too. Monarx saw malicious file uploads nearly triple through November and December, high shopping traffic meeting reduced staffing. If you run a store, that is the stretch where a slow response costs the most.
Old vulnerabilities also deserve more respect than they get. Of the ten most-targeted vulnerabilities Patchstack blocked during 2025, only four were published that year. The rest date to 2023 and 2024 and are still being attacked, which tells you those vulnerable versions are still sitting on live sites right now.

 Consider a VPN for additional protection
Plugin security is only one part of protecting a WordPress site. If you or your team frequently manage websites from public Wi-Fi, remote locations, or shared networks, a VPN can add another layer of connection security.
For individual site owners and freelancers, NordVPN provides encrypted internet connections and privacy-focused features for everyday browsing and remote work.
For agencies, businesses, and teams managing multiple WordPress websites, **NordLayer** is designed specifically for business use, with secure remote access, centralized management, dedicated IP options, and access-control features.
A VPN does not replace WordPress patching, backups, vulnerability monitoring, or access controls. Instead, it should be treated as one layer within a broader security strategy.

 The uncomfortable part
Most small sites will not do any of this. The economics do not support it. A local business paying someone a small monthly retainer to keep their site alive is not buying a security program, and pretending otherwise helps nobody.
What has changed is that the cheap version of security, updating plugins when you get round to it, used to be roughly adequate. Attackers were slower, patches usually existed by disclosure, hosts caught more of what got through. That situation no longer holds, and the standard advice has not caught up.
If you only do one thing, reduce the plugin count. It costs nothing, it takes an afternoon, and it shrinks the exact part of the attack surface that generates 91% of the problem.
---