WordPress is the most widely used content management system in the world, and that popularity comes with a serious downside: it makes WordPress the largest attack surface on the web. Right now, roughly 43% of all websites run on WordPress. That market share is both the platform's greatest strength and the reason it attracts more malicious attention than any other CMS by a wide margin.
If your business has a WordPress site — whether I built it for you or someone else did — you need to understand what the threat landscape actually looks like in 2026, and what a well-run security posture looks like in response.
The Scale of the Problem
The numbers from 2025 are worth sitting with for a moment. Security researchers recorded 11,334 new WordPress vulnerabilities that year — a 42% increase year over year. That's not a plateau. That's a curve moving in the wrong direction.
Roughly 13,000 WordPress sites are compromised every single day, which works out to somewhere around 4.7 million sites per year. And the average exploitation window — the time between a vulnerability being publicly disclosed and active attacks targeting it — is just 5 hours.
Five hours. That means by the time a developer hears about a newly discovered flaw in a plugin they're running, automated scanning tools have often already started probing for vulnerable installations.
I want to be direct about this without being alarmist: these numbers don't mean WordPress is broken or that you should abandon it. WordPress is a mature, well-supported platform, and running it safely is entirely achievable. But it does mean that "set it and forget it" is not a viable approach, and that the businesses most at risk are the ones who think their site is too small to matter.
Why Small Sites Are Targeted Too
One of the most common misconceptions I encounter with small business clients is the assumption that attackers go after big targets. The reality is almost the opposite for web-based attacks.
The vast majority of WordPress compromises are carried out by automated bots, not individual hackers who sat down and chose your site specifically. These bots scan the internet continuously, looking for known vulnerabilities in specific plugin versions, weak or default credentials, exposed login pages, and misconfigured servers. They don't care whether you're a regional vascular clinic or a Fortune 500 company. If your installation matches their criteria, the bot flags it and exploitation begins.
Your site's size is irrelevant to a bot. What matters is whether it's vulnerable.
WP2Shell: The Critical Vulnerability of 2026
On July 17, 2026, a critical vulnerability chain was disclosed under CVE-2026-60137 and CVE-2026-63030, collectively known as WP2Shell. This one is significant and worth understanding in plain terms.
WP2Shell exploits the WordPress REST API batch endpoint — a legitimate feature built into WordPress core — in a way that allows an unauthenticated attacker to create a new administrator account and execute arbitrary code on the server. No login required. No brute force. An attacker who finds a vulnerable installation can, in a single automated sequence, gain full administrative control and run whatever code they choose on your server.
The vulnerability was actively exploited in the wild following disclosure. Given the 5-hour average exploitation window I mentioned earlier, any unprotected site that hadn't been patched was at risk almost immediately after the disclosure became public.
This is a real-world example of why reactive security — waiting until there's a problem and then addressing it — isn't sufficient. By the time you know WP2Shell exists and go looking for a fix, automated attacks may have already found your site.
How Attacks Actually Happen
WP2Shell represents one end of the sophistication spectrum. But most compromises don't require anything that elaborate. The most common attack vectors I see against WordPress sites break down into a few recurring categories:
Plugin and theme vulnerabilities. This is the most common entry point by far. Outdated plugins — especially those that haven't been actively maintained — often carry known vulnerabilities for XSS (cross-site scripting), broken access control, SQL injection, and remote code execution. You install a plugin once, forget about it, and six months later it becomes the door that lets someone in.
Brute force attacks against login pages. WordPress's default login URL (/wp-admin) is publicly known. Bots hammer it with credential combinations constantly. If you're using a weak password or, worse, leaving the default admin username in place, this is a straightforward path to compromise.
Cross-site request forgery (CSRF). Attackers can trick an authenticated user into unknowingly performing administrative actions by crafting a malicious request. If an admin is logged in and clicks the wrong link, certain vulnerability types allow an attacker to execute that action with their credentials.
Credential stuffing. When credentials are leaked in third-party data breaches — which happens constantly — attackers test those username and password combinations against WordPress sites at scale. Password reuse is one of the most underestimated risks in small business web security.
How We Protect Client Sites
Over the years I've built a layered security approach that I use consistently across the client sites I manage. No single tool eliminates all risk, but a well-layered stack significantly reduces your attack surface and your response time when something does go wrong.
Here's what that looks like in practice.
Patchstack is the foundation of our security monitoring. It provides firewall protection, continuous vulnerability scanning, and something called virtual patching that I want to explain specifically because it's genuinely important. When a new vulnerability is disclosed — like WP2Shell in July — there's often a gap between disclosure and the moment the plugin or theme developer releases an official patch. Virtual patching closes that gap by patching the vulnerability at the firewall level before the official fix even exists. Your site is protected from the exploit while the developer is still writing the fix. Given the 5-hour exploitation window I referenced earlier, this capability is not optional — it's essential.
WP Engine is the hosting platform we use for primary client sites. It provides daily backups, automated disaster recovery, and server-level security hardening that goes beyond what most shared hosting environments offer. If something goes wrong, we can restore to a clean state quickly.
WPBackup handles sites hosted in environments outside WP Engine. Backup coverage should never have a gap, regardless of the host.
Custom login URL. We change the default WordPress login path away from /wp-admin for every site we manage. This sounds simple, but it meaningfully reduces the volume of automated brute force traffic hitting your login page. Bots scanning for /wp-admin don't find anything to attack.
Plugin and theme updates are run four times a month by a team member. This maintenance work may sound routine, but it is genuinely one of the most important things we do. Most exploited vulnerabilities have had a patch available — the problem is sites that haven't applied it.
Monthly form data clearouts keep client databases clean and reduce the sensitive data footprint. This matters particularly for healthcare clients where HIPAA compliance is a factor. We also use Termageddon to keep privacy policies current and legally compliant as regulations change.
Divi Accessibility plugin is deployed on healthcare and legal client sites to ensure ADA compliance — not a security tool, but part of maintaining a legally and technically sound site overall.
The Mindset Behind All of This
I've seen the aftermath of compromised sites — spam injected into pages, client data exposed, search rankings destroyed by blacklisting, and thousands of dollars in emergency remediation costs. I've also never had a client site successfully compromised under our management, and I attribute that directly to the layered approach above.
The key mindset shift for business owners is this: security isn't a one-time setup. It's a continuous practice. The threat landscape changes. New vulnerabilities are disclosed every week. Bots evolve. The only effective response is a stack that monitors, patches, updates, and backs up on a consistent schedule — not just when something breaks.
Your site is an asset. It generates leads, builds credibility, and supports your revenue. Treating its security as an afterthought is the equivalent of leaving your business unlocked every night because nothing bad has happened yet.
Ready to Talk About Your Site's Security?
If you're not sure what security tools are running on your WordPress site, or if you've never had a proper security review, I'd encourage you to reach out. A 15-minute conversation can tell me a lot about where you stand and what, if anything, needs to change.
Site Ascension offers free consultations for business owners who want to understand their risk and get a clear picture of what a well-protected WordPress site looks like. No pressure, no jargon — just a straight answer about where things are and what I'd recommend.
Call us today at 713.331.9940 or get in touch directly. I'm happy to take a look.
