In short:  For the WordPress flaws attackers target most, the median time from public disclosure to mass exploitation is now about five hours — and 46% of vulnerabilities have no patch available the day they’re disclosed. Weekly update cycles no longer match the threat. Continuous monitoring and virtual patching do.

Five hours: the new normal

Five hours. According to Patchstack’s State of WordPress Security in 2026 report, that’s the weighted median time — for the most heavily targeted vulnerabilities — between a flaw being publicly disclosed and the first wave of mass exploitation in the wild. Not five days. Not five weeks. Five hours.

A quick note on that number, because precision matters: five hours isn’t the average for every bug. It’s the weighted median for the flaws attackers actually pile onto — weighted by how intense the exploitation gets. The broader figure is nearly as sobering: about half of all high-impact vulnerabilities are exploited within 24 hours of disclosure. Either way, if your update strategy is “I’ll check on it this weekend,” you’re not operating on a schedule that matches the current threat environment.

How the botnet economy works

The botnets that exploit WordPress vulnerabilities are automated and always running. They don’t take weekends. They don’t wait for business hours. They continuously scan millions of sites, comparing installed plugin versions against a database of known vulnerabilities, and they begin exploitation the moment a viable target is identified.

The economics are what make this dangerous for small sites. When the cost of attacking a target approaches zero, even low-value targets — a solo therapist’s website, a small non-profit — are worth exploiting. You don’t have to be important to be attacked; you just have to be reachable. By one estimate drawing on Patchstack’s data, roughly 13,000 WordPress sites are compromised every day.

91% of the risk lives in your plugins

WordPress core is maintained by a large, well-resourced team with a strong security track record. In all of 2025, only six vulnerabilities were reported in WordPress core — all of them low-risk. The danger lives in the ecosystem of plugins that most business websites accumulate: contact forms, gallery tools, SEO plugins, booking systems, event calendars. Patchstack found that 91% of new vulnerabilities in 2025 were in plugins.

Two numbers make the plugin problem worse than it first sounds. First, 43% of these vulnerabilities can be exploited with no login at all — any anonymous bot can trigger them. Second, 46% had no patch available on the day they were disclosed. And Patchstack found that premium plugins and themes were associated with roughly three times as many known-exploited vulnerabilities as free ones — paying for a plugin is not the same as it being safe.

The silent infection: what modern hacks look like

Modern attacks rarely crash your website — that would tip you off. Instead they work quietly:

• They mine cryptocurrency using your server’s processing power, slowing your site and running up your hosting bill.
• They create hidden admin accounts so they keep access even after the original hole is closed.
• They inject invisible spam links that drag down your domain’s reputation and rankings with Google.
• They harvest your client contact list and sell it.

You may not know you’ve been compromised for weeks — until your traffic mysteriously drops, a client calls to report something alarming, or Google adds a warning to your search listing.

Why weekly updates are no longer enough

The five-hour window breaks the traditional advice. “Keep your plugins updated” assumes you have days to react. For heavily targeted vulnerabilities, you often have hours — and a weekly or monthly cycle simply can’t move that fast. Patchstack puts it bluntly in the report: regular plugin updates are a second line of defense, but when attackers weaponize new vulnerabilities within mere hours, updates alone are not a viable defense.

There’s an even more uncomfortable wrinkle. Remember that 46% of vulnerabilities have no patch on the day they go public. In those cases there is literally nothing to update — the hole is known, actively scanned for, and the plugin is still broken. The only thing that protects you in that gap is a layer that can block the exploit before a fix exists.

Connect4 Tip

You can’t patch a hole that doesn’t have a patch yet — and 46% of the time, there isn’t one on day one. That single fact is the entire case for a WordPress-specific firewall that can block an exploit before the official fix exists. Updates are necessary. They’re just no longer sufficient on their own.

“Should I just use something other than WordPress, then?”

It’s a fair question — and the honest answer is: usually not for security reasons alone. Switching platforms tends to solve the wrong problem.

Start with what the data actually says. WordPress core isn’t the weak point — six low-risk vulnerabilities in a year is an excellent track record. The risk comes from two things: the open plugin ecosystem, and the fact that WordPress runs about 43% of the web, which makes it the single biggest target for automated attacks. Any platform that large and that open would attract the same swarm. Part of why you hear about WordPress vulnerabilities at all is that they’re publicly disclosed — which is a strength, not a weakness. The holes you never hear about on a closed platform don’t stop existing.

That said, hosted, closed platforms — Squarespace, Wix, Shopify — do have a real, honest advantage here: they manage server security and updates for you, and there’s a much smaller third-party plugin surface to go wrong. If you have a simple brochure site and you never want to think about maintenance, that’s a legitimate trade to make.

But it is a trade. In exchange you give up flexibility and custom functionality, deep control over SEO and performance, the ability to integrate the specific tools your business runs on, and — crucially — ownership. You don’t own the platform; you rent space on someone else’s. And hosted builders are not magic: they still get breached, and you’re still responsible for strong passwords, two-factor authentication, and the security of any third-party apps or integrations you bolt on.

The real bottom line is this: the problem isn’t WordPress, it’s unmaintained WordPress. A well-maintained WordPress site — tested updates, a WordPress-specific firewall, hardened logins, real backups — is secure and gives you power no hosted builder can match. A neglected one is a liability on any platform. If your website is a genuine business asset, migrating a working site purely out of security fear is an expensive answer to a question that ongoing maintenance already solves.

What you can do right now (no developer needed)

• Turn on automatic updates for plugins, themes, and core at minimum. Auto-updates aren’t perfect, but for most small sites they beat a manual weekly cycle by days — and days are the whole game here.
• Enable two-factor authentication on every admin account. With 43% of vulnerabilities needing no login, locking down the logins you do control is the highest-ROI ten minutes you can spend today.
• Delete plugins you don’t use. Go to Plugins → Installed Plugins and remove anything inactive or abandoned. Every plugin you don’t need is attack surface you can eliminate for free.
• Install a security plugin with a firewall. The free Wordfence Security plugin includes a firewall and malware scanner — turn both on and run a full scan.
• Confirm your backups work. Make sure daily backups exist and that you’ve actually restored one. An untested backup is a hope, not a plan.

Where Connect4 can help

The do-it-yourself steps close the easy gaps. Closing the five-hour gap — reliably, around the clock, without you watching for it — is what a managed care plan is for.

• Continuous vulnerability monitoring, not a weekly glance — automated systems that watch for new disclosures affecting your specific plugins as they happen.
• Virtual patching via a WordPress-specific firewall that blocks a known exploit at the traffic level within hours of disclosure — covering you during the gap before the plugin developer ships a fix, including the 46% of cases where no fix exists yet.
• Staging-tested updates applied fast, so patches go live quickly without risking your live site.
• Real-time malware scanning with alerting, so a compromise is caught and remediated in hours — long before Google finds it for you.
• A real 3-2-1 backup strategy — three copies, two media types, one off-site — with periodic restore tests.
• All of it rolled into a monthly care plan, so security, performance, and updates are handled continuously rather than whenever someone remembers to log in.

Frequently asked questions

How fast are WordPress vulnerabilities exploited after disclosure?

For the most heavily targeted vulnerabilities, Patchstack’s 2026 report puts the weighted median time from disclosure to mass exploitation at just five hours. About half of all high-impact vulnerabilities are exploited within 24 hours, and 70% of heavily targeted ones within a week.

Why isn’t updating my plugins once a week enough?

Because attackers weaponize the most-targeted flaws within hours of disclosure, and 46% of vulnerabilities have no patch available on the day they’re disclosed. A weekly or monthly cycle assumes you have days to react — for high-priority flaws, you often have hours.

Should I switch to Squarespace, Wix, or another platform instead of WordPress?

Usually not for security reasons alone. WordPress core is very secure; the risk comes from unmaintained plugins and WordPress being the web’s biggest target. A maintained WordPress site is safe. Hosted builders reduce upkeep but trade away flexibility, ownership, and control.

What does virtual (real-time) patching actually mean?

Virtual patching uses a WordPress-specific firewall to block a known exploit at the traffic level within hours of disclosure — protecting your site during the gap before the plugin developer ships an official fix. It’s the layer weekly updates can’t provide.

How many WordPress sites actually get hacked?

Patchstack recorded 11,334 new WordPress vulnerabilities in 2025, up 42% year over year, and by one estimate roughly 13,000 WordPress sites are compromised every day. The overwhelming majority trace back to plugin vulnerabilities, not WordPress core.

Speed is the whole game

The defining fact of WordPress security in 2026 is speed. The systems attacking your site are automated, tireless, and faster than any human update schedule can reliably beat on its own. You will not out-click a bot that starts working five hours after a vulnerability goes public — and you can’t manually patch a hole that has no patch yet.

The answer isn’t to panic, and it isn’t to abandon the platform that runs 43% of the web. It’s to put protection in place that operates on the same timeline the threat does: continuous monitoring, virtual patching, and fast, tested updates. If you’d rather not spend your evenings racing botnets, that’s exactly what a care plan is for.