# WordPress plugin security: where the real risk sits

**WordPress plugin security** is where most of the risk concentrates today. Many small companies are in the same situation without realising it: they have a WordPress site that works, it is updated when someone remembers, and nobody asks too much about what happens behind the scenes. As long as everything runs, it looks like a technical detail for whoever built the site. Then a breach happens, and the problem turns out to have always been in the site's architecture.

## A flaw affecting half a billion sites

In recent weeks a security researcher disclosed a critical vulnerability in the WordPress core itself: a flaw that lets an anonymous attacker execute remote code without credentials, on a clean installation, without even a third-party plugin. It affects around 500 million sites on the affected versions. In the same period, Cloudflare had to release dedicated firewall rules for two other critical WordPress vulnerabilities, again remotely exploitable.

## Where the risk really concentrates

According to Sucuri's malware infection report, **more than 90%** of compromised sites detected across all CMS platforms run WordPress. On its own, that figure might seem unfair to a platform that powers almost half the web. A second figure makes it more precise: according to Patchstack's State of WordPress Security report, 91% of vulnerabilities found in 2025 concerned third-party plugins, leaving the software core a marginal role. And the average time between the public disclosure of a flaw and the first large-scale attack is **just five hours**.

This means something precise: the more plugins, themes, integrations and external components a site accumulates over time, the larger its attack surface grows, regardless of how well curated the published content is. Every added element is a potential extra entry point, and the window to apply a patch before someone exploits it has shrunk to a few hours. Chasing updates week after week, for a small company without a dedicated IT department, is almost impossible to sustain consistently.

## An architecture that removes the problem at the root

There is a question worth asking before continuing to chase patches and updates: is that attack surface really necessary to publish an editorial site, a corporate blog or the pages describing your services? **In most cases, no.** A site that generates static pages instead of running PHP code and querying a database on every visit removes the most widespread category of attack at the root: if there is nothing to execute in production, there is almost nothing to exploit. There is no longer any need to chase security updates on plugins nobody remembers installing.

## What changes with RawPress

This is the principle behind RawPress CMS, the tool developed internally by EBM Solution for those who write content locally and publish only ready-made HTML files, without ever exposing a dynamic server online. Migrating from an existing WordPress site keeps permalinks, SEO metadata and content structure, with a setup time estimated at one to two hours: a detail that matters, because the most common fear for anyone considering a platform change is losing the ranking built up over time.

For anyone who has managed a corporate site for a few years, the question is less whether WordPress is a good choice in general. It is whether their installation, with the plugins accumulated over time, still deserves to stay exposed online twenty-four hours a day.

Plugins are one symptom of [tool sprawl in the digital architecture](/en/ecorner/2026/digital-architecture-tool-sprawl.html), which turns maintenance into a permanent cost.

## Frequently asked questions

**Is WordPress an insecure platform compared with other CMSs?**
The problem mainly concerns the accumulation of plugins and third-party components over time, which progressively widens the attack surface regardless of the platform chosen. The core code, according to Patchstack data, represents only a minimal share of the vulnerabilities found.

**What does attack surface mean in practice for a corporate site?**
It is the set of points through which a system can be reached by an attacker: server-side code being executed, a queryable database, plugins with write permissions. The more those points grow over time, the more opportunities there are for unauthorised access.

**Does moving from WordPress to a static site mean losing search ranking?**
A well-executed migration keeps the existing permalinks, meta tags and content structure, so search engines keep finding the same pages at the same addresses. It is one of the aspects worth checking carefully in the migration tool you choose.

**Can a static site still handle dynamic features such as contact forms or e-commerce?**
Yes, through modules developed separately and placed alongside the static part of the site, keeping the attack surface of the main editorial part isolated from the features that genuinely require server-side logic.

## Sources

Searchlight Cyber — WP2Shell: technical analysis of a pre-authentication remote code execution vulnerability in the WordPress core — https://slcyber.io/research-center/wp2shell-pre-authentication-rce-in-wordpress-core/
Cloudflare — dedicated firewall rules released for two high-severity remotely exploitable WordPress vulnerabilities — https://blog.cloudflare.com/wordpress-vulnerabilities/
Sucuri — report on malware infections detected on websites, with the CMS comparison and WordPress share — https://sucuri.net/reports/2023-hacked-website-report/
Patchstack — State of WordPress Security in 2026, with the split of vulnerabilities between core and third-party plugins — https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/
RawPress CMS — EBM Solution's tool for publishing static sites and migrating from existing WordPress installations — https://rawpress.ebmsolution.com/