Patchstack's 2025 State of WordPress Security report documented 7,966 new vulnerabilities across the WordPress plugin and theme ecosystem in 2024. That is a 34% increase over 2023. In 2025, the pace accelerated further — a 20.6% year-over-year increase. 92% of successful WordPress compromises in 2025 originated from plugins or themes, not from WordPress core itself.
The numbers are large enough to be abstract. The June 2024 supply chain attack is not abstract.
The 2024 Supply Chain Attack
In June 2024, an attacker gained access to five WordPress.org developer accounts using credentials stolen in earlier, unrelated data breaches — a credential-stuffing attack requiring no sophisticated hacking. The attacker then pushed malicious updates to those developers' plugins. Any site with auto-updates enabled received the malware automatically.
The injected code did three things: it created hidden administrator accounts, it sent data to attacker-controlled servers, and it injected SEO spam into site footers. Wordfence documented three additional compromised plugins in a follow-up report the same week. The attack spread through the same mechanism used to deliver security patches — the WordPress update system itself.
CVE-2024-27956: The Most Exploited Plugin CVE of 2024
The WP Automatic plugin, installed across a large number of WordPress sites, contained a SQL injection vulnerability rated 9.9 out of 10 on the CVSS severity scale. Disclosed in March 2024, the vulnerability allows an unauthenticated attacker to create administrator accounts. WPScan recorded more than 5.5 million exploitation attempts, with the heaviest wave hitting on March 31, 2024.
Attackers used the vulnerability to plant backdoors and rename plugin files to disguise the compromise from basic security scans. Many affected sites remained compromised long after the patch was released, because the backdoors persisted independently of the plugin.
The Abandonment Problem
In 2024, WordPress.org removed 1,614 plugins and themes from its repository due to unpatched security issues. Most of those plugins remain installed on live sites. WordPress does not send removal notifications to site owners. An active plugin that gets quietly removed from the repository continues running — unpatched, unsupported, and now invisible to WordPress update checks — until someone manually investigates.
More than half of plugin developers who were notified of vulnerabilities through the official disclosure process did not publish a patch before public disclosure. Responsible disclosure timelines give vendors 90 days to patch before CVE publication. The majority of WordPress plugin vendors miss that window entirely.
- Run a plugin audit — deactivate anything unused
- Check the WordPress.org repository for plugins with no recent updates
- Enable two-factor authentication on every admin account
- Verify auto-updates are scoped to trusted plugins only
- Use a vulnerability scanner (Patchstack, Wordfence) on a schedule — not just after an incident
