5 Hours to Impact: Why WordPress Security Has Become a Business Risk

Most WordPress hacks do not happen the way many business owners imagine. It is usually not one person sitting at a keyboard, studying your site, and deciding to break in.

More often, it is automated software scanning the internet, looking for outdated plugins, abandoned themes, weak admin accounts, and known vulnerabilities. When it finds one, the attack can happen fast. That is the part businesses need to understand.

Based on published industry baselines, an estimated 300,000 to 390,000 WordPress websites may be compromised globally in a typical 30-day period. That should not be treated as an exact count: cybersecurity companies do not track every hacked site in real time. But the estimate points to something real. WordPress runs a huge part of the web, and that makes it a huge target.

W3Techs currently lists WordPress at about 40.7% of all websites. That kind of reach is exactly why attackers build tools that look for WordPress weaknesses at scale.

But the number of hacked sites is not the only concern. The bigger problem is speed.

Patchstack's 2026 WordPress security report found that heavily exploited vulnerabilities are being weaponized within a weighted median time of just 5 hours. That means once a serious vulnerability becomes public, attackers may begin scanning for exposed websites the same day, in some cases before a business owner even knows there is a problem.

For years, WordPress maintenance has been treated like a routine checklist:

• Update the plugins
• Update the theme
• Update WordPress core
• Run a backup
• Move on

That approach is no longer enough by itself. When the attack window is measured in hours, weekly or monthly maintenance can leave a site exposed for too long.

This Is Not Just a WordPress Core Problem

It is easy to say, "WordPress is unsafe." That is not really the full story.

The bigger issue is the WordPress ecosystem. Most business websites are not just WordPress. They are WordPress plus a page builder, contact form plugin, SEO plugin, backup plugin, analytics plugin, cookie banner, security plugin, slider, custom theme, tracking scripts, and years of old add-ons from past redesigns. Even a core release built for safety, like WordPress 7.1, cannot patch a plugin the developer never revisits.

Some of those plugins are useful. Some are forgotten. Some were installed for one task and never removed. Every plugin adds functionality, and every plugin also adds another place where something can go wrong.

Patchstack reported 11,334 new WordPress ecosystem vulnerabilities in 2025, a 42% increase over the year before. Even more telling, 91% of those vulnerabilities were found in plugins. Only 6 were reported in WordPress core, and those were considered low priority.

That is an important distinction. For most businesses, the risk is not simply "we use WordPress." The risk is, "we use WordPress, and our site depends on a stack of third-party tools that all have to be updated, monitored, tested, and secured."

A Backup Plugin Can Become an Attack Surface

A recent Wordfence disclosure shows how quickly a normal business tool can become a serious security issue.

Wordfence reported an unauthenticated second-order SQL injection vulnerability in the All-in-One WP Migration and Backup plugin, which has more than 5 million active installations.

The vulnerability affected versions up to and including 7.109, with version 7.110 released as the patch. According to Wordfence, the flaw could allow unauthenticated attackers to plant SQL that later executes when an administrator performs an archive restore, potentially leading to secret key exposure, remote code execution, and complete site takeover.

That is the kind of issue most business owners would never see coming. A backup or migration plugin sounds harmless. In many cases, it is installed during a redesign, migration, or troubleshooting process, then left sitting on the site long after the work is finished. But if that plugin remains active and vulnerable, it becomes part of the attack surface.

That is why security is not just about what a site does on the front end. It is also about what is installed behind the scenes.

How a Technical Issue Turns Into a Business Problem

SQL injection sounds like something only a developer needs to worry about. But the impact can become very practical, very quickly.

At a high level, SQL injection happens when software does not properly handle user input before sending it to the database. If vulnerable code can be reached without logging in, an attacker does not need a username or password; they can send malicious requests directly to the site and attempt to manipulate how the database responds.

From there, the damage can grow. An attacker may be able to expose sensitive data, gain deeper access, upload malicious files, create hidden backdoors, inject spam pages, redirect visitors, steal information, or use the site as part of a larger malware operation.

To the business owner, the first sign may not look like a "hack" at all. It may look like:

• Strange casino pages showing up in Google
• A browser warning
• A contact form that stops working
• Missing leads
• A drop in rankings
• Customers saying they were redirected somewhere else

By the time the problem is visible, the site may have been compromised for days, weeks, or longer.

Hacked Websites Are Often Used as Infrastructure

A hacked website is not always the final target. Sometimes the website becomes a tool.

Check Point Research documented a campaign called StopAndProtect that abused thousands of compromised WordPress websites as infrastructure. Those sites were used to spread malware, control infected machines, and store stolen documents, screenshots, and activity logs.

The campaign used fake CAPTCHA prompts and a multi-stage malware chain that could include ransomware, credential theft, file encryption, and data exfiltration.

That is where the risk becomes bigger than one website. A neglected site can be used to attack visitors. It can host malware. It can hide stolen data. It can become part of a spam network. It can damage search visibility and brand trust long before anyone inside the company realizes what happened.

Check Point also noted that one compromised site in the campaign was running a WordPress version from 2021 and had nearly 40 identifiable vulnerabilities. That is not a small maintenance miss. That is years of neglect sitting online, waiting to be found.

The Old Maintenance Model Is Breaking

The traditional website maintenance model assumes there is time:

• Time to learn about the vulnerability
• Time for the developer to release a patch
• Time for the website owner to apply the update
• Time to test whether the update breaks the site
• Time to clean up if something goes wrong

Modern attacks do not wait for that timeline. Patchstack reported that 46% of vulnerabilities were not fixed by the developer in time for public disclosure. That means a website can be exposed even when the site owner is willing to update, which is a major problem: it means security can no longer depend only on someone manually logging in every so often and clicking update.

A modern website security approach needs layers. It needs fewer unnecessary plugins. It needs fast patching. It needs a firewall or virtual patching layer. It needs strong admin access controls. It needs off-site backups. It needs malware scanning. It needs change monitoring. And it needs a real recovery plan.

For some businesses, it may also mean asking a bigger question: is a plugin-heavy WordPress setup still the right fit for what this website does?

What Business Owners Should Do Now

The practical advice is simple: do not wait until the website looks broken.

Start with a full plugin and theme audit. Remove anything unused, outdated, abandoned, duplicated, or unnecessary. Many WordPress sites are carrying old plugins from past redesigns, temporary marketing campaigns, form experiments, page builders, backup tools, and tracking scripts.

Then review administrator accounts. Remove users who no longer need access. Require strong passwords. Turn on two-factor authentication. A site can be well built and still be compromised through an old admin account.

Next, review backups. A backup is only useful if it is recent, clean, stored off-site, and actually restorable. Too many businesses find out too late that their backup is outdated, corrupted, incomplete, or stored on the same compromised server.

Finally, review the platform itself. WordPress can still be a strong fit when it is built carefully, maintained properly, and monitored consistently, but it is not a set-it-and-forget-it system.

If a business depends on its website for leads, forms, applications, search rankings, payments, or customer trust, then website security is not just an IT issue. It is an operational risk.

The Real Question

The lesson is not that every business should panic. The lesson is that the web has changed.

Attackers are automated. Vulnerabilities move quickly. Plugins are constantly being tested. Compromised websites are being used as part of larger criminal systems. And the gap between "a patch exists" and "our site is protected" may be much wider than most companies realize.

Security cannot be something that gets considered after launch. It has to be part of how a website is built, hosted, maintained, monitored, and eventually replaced when the platform no longer fits the risk profile of the business.

For business owners, the question is not just, is our website online? The better question is: is our website being actively protected, or are we just hoping nothing finds it?

Talk to us about a security and maintenance review, and let's find out which one is true for your site.