Five Hours to Exploitation: Rethinking WordPress Security

Ido

Last time we left a question hanging. When AI agents get database and system access to a WordPress site, who holds the keys, and who audits the code? Today we're going underneath that question, because there's a more basic problem. The way most agencies handle updates may already be broken.

Nick d

And it's a problem I see constantly. The old playbook was simple. Run updates weekly or monthly, put a general web application firewall at the host, and clean up files if malware shows up. The State of WordPress Security 2026 report from Patchstack says that model has collapsed. The number that should bother you is five hours. That's the weighted median time to mass exploitation for heavily exploited vulnerabilities. Weighted means they account for how intense the attacks were. About half of the high impact vulnerabilities get exploited within 24 hours.

Ben cohen

Now put that next to a monthly update schedule. Thirty days against five hours. And it gets worse, because 46 percent of vulnerabilities published in 2025 had no developer patch at the moment of public disclosure. So even a perfect agency, one that updates the minute a notice lands, has nothing to install for nearly half of them. Updating is not a defense in that window. It's cleanup.

Ido

And the volume is climbing. The ecosystem logged 11,334 new vulnerabilities in 2025, up 42 percent from the year before. Of those, 1,966 were high severity, the kind likely to be hit by automated mass attacks, and that category was up 113 percent. One note. Patchstack classifies those severities, and Patchstack sells protection. It's the best data we have, but it comes from a vendor.

Nick d

Right, so weigh it as a good vendor dataset. Now the part that surprises people is hosting. Patchstack ran a large scale pentest of popular hosting companies, and only 26 percent of vulnerability attacks were blocked. In the targeted testing we've been given, it was only 12 percent. The reason is that the most exploited category is Broken Access Control. Those requests look like normal authenticated traffic. There's no obvious injection pattern for a general firewall to catch. So when a host says it has a WAF, that is not a patching strategy.

Ben cohen

Then there's the premium paradox, which I think agencies hate hearing. Components from marketplaces like Envato had three times more known exploited vulnerabilities than free plugins from the WordPress.org repository. And 76 percent of the vulnerabilities found in premium components were exploitable in real attacks. Patchstack's zero day program found 33 highly critical issues in premium components versus 12 in free ones. Their explanation is access. The code sits behind a paywall, so independent researchers rarely look at it. That's their reading, and I think it's fair. It says fewer eyes, not necessarily worse developers.

Ido

And this ties back to our open question. This week's news had Angie from the Elementor team shipping a super admin mode that can read and write the file system, query the database and execute PHP. Novamira and SproutOS offer similar reach through MCP. I want to be clear that this next part is my interpretation, not from the report. The more power that sits inside a site, the less time you can afford between a disclosure and a defense. Five hours is not much time to audit anything.

Ben cohen

And attackers aren't just getting faster, they're getting quieter. Patchstack partnered with Monarx, who looked at about nine trillion file signals. Uploader scripts nearly doubled in mid 2025 and stayed high. That means attackers want a persistent way back in, so they can drop secondary payloads long after your cleanup. They also rarely drop a standalone bad file. They inject small snippets into legitimate core and plugin files.

Nick d

Which makes cleanup painful. One family called Lock360 runs resident in server memory, and it rewrites cleaned index.php and .htaccess files within seconds of restoration. So you think you fixed it, and it undoes your fix before you've closed the tab. When it comes to recovering a client site, that's a different job than deleting a file.

Ben cohen

And this one is my area, because it touches AI visibility. A campaign called Parrot TDS inspects each request and serves different things to different visitors. Keyword spam goes to search bots, exploits go to human visitors, and clean, unmodified pages go to AI training crawlers like ChatGPTBot and Google Gemini. So if your audit is an AI tool reading your site, it may report a clean page while real visitors get attacked. A view through an AI reader is useful, but it can't be your only check.

Ido

One more timing detail. Malicious file uploads triple in November and December. Attackers aim at peak shopping traffic and skeleton agency staffing. So the worst week for an incident is the week your team is on holiday.

Nick d

So here's a practical workflow. First, move from post boom to pre boom. That means application level virtual patching, something like Patchstack's RapidMitigate, which blocks exploit patterns in real time without changing source code. Yes, that's a vendor product, and you should compare options. But the principle is that protection arrives at disclosure, not when the author ships a fix. Second, least privilege. Use something like Melapress Role Editor to trim who can do what, turn on two factor authentication with WP 2FA, and lock down file permissions on production so a compromised plugin can't write wherever it likes.

Ben cohen

Third is vetting, and I'd say treat every plugin as untrusted third party code. Does the vendor run a verified vulnerability disclosure program? Does it lean on unmaintained dependencies? When you uninstall it, does it clean up its database tables and options, or leave orphans behind? And ask whether you need it at all. Every redundant utility plugin is more surface for those five hours.

Ido

There's regulatory pressure here too. The EU Cyber Resilience Act now pushes commercial plugin vendors toward a formal disclosure program. At the same time, maintainers are drowning in AI generated slop reports, invalid bug bounty submissions that eat engineering time. So the people who have to patch fast are also being buried in noise.

Nick d

And core isn't exempt. WordPress 7.0.2 was an emergency security release, fixing a REST API batch route confusion and SQL injection that could lead to remote code execution, plus a separate facilitated SQL injection issue. If you haven't updated every site to it, you can do that in just a few clicks with a bulk tool, so do it today.

Ido

So here's the takeaway. The question from last time was who holds the keys. This one is who's watching at hour five. This week, audit your clients' plugin lists, flag the premium and abandoned ones, and decide what protects each site before the next disclosure, not after.