WordPress doesn't break on its own: the risk is in plugins and outdated PHP

Where the holes show up

In 2025, 11,334 new vulnerabilities were published in the WordPress ecosystem, 42% more than the year before, according to Patchstack's annual report. 91% were in plugins, 9% in themes and only six in WordPress core, all of them low risk.

The takeaway isn't that WordPress is insecure. It's that every plugin adds someone else's code, with its own update pace. A site with thirty plugins depends on thirty different teams.

And a fix isn't always ready in time: according to the same report, 46% of those vulnerabilities had no patch when they were made public.

The PHP nobody looks at

WordPress runs on PHP, and PHP expires too. Each version gets two years of improvements and two more of security fixes; after that, nothing. PHP 8.1 stopped getting patches on December 31, 2025, and PHP 8.2 follows on December 31, 2026.

In early 2026, according to the WordPress team's own data, more than 20% of sites were still on PHP 8.0 or 8.1, both already expired, and another 27% on 8.2. An expired version doesn't break overnight: it stops getting fixes, and every new flaw found stays open.

The site owner rarely decides this: the host does, and many plans don't upgrade it unless someone asks.

What to check if you run WordPress

Your PHP version: it's usually in your hosting panel. If it's 8.2 or older, ask for 8.3 or newer, and test the site on a copy first. If a plugin doesn't support it, that's a warning too.

Your plugins: delete the ones you don't use; deactivating isn't enough. Be wary of any that haven't been updated in over a year, and turn on automatic updates for the rest.

The rest: backups stored off the server, one user per person and two-factor sign-in for the admin panel.

When something else makes more sense

WordPress is still a good tool when you need what it brings: an editor many people know, hundreds of integrations, someone publishing every day. What tends to get expensive is using it for a five-page site that changes twice a year, with fifteen plugins to do what it doesn't.

At Hako we work in Next.js, without WordPress: each site carries only the code it needs, and whatever doesn't have to change on every visit is published as ready-made pages. That doesn't make it invulnerable, since it also has dependencies that need to stay up to date. But they're few, we pick them, and we know what each one does.