WordPress Security Realities and the Rise of AI Agents

Nick d

Welcome to Wpfavs, your favourite WordPress news. Today's pain point is simple. GuardingWP published its first State of WordPress Security 2026 report, and the headline number is that 52.8 percent of scanned sites were running at least one plugin with a known vulnerability at scan time. More than half.

Ido

And that's the number I can't stop thinking about, because the same week those numbers landed, we're all excited about AI agents that can touch the server. Novamira CLI now lets a terminal coding agent like Claude Code, Codex CLI or Gemini CLI run commands against a WordPress site. Angie from the Elementor team has a Super Admin Mode that can read and write the file system, query the database, execute PHP, and do what you'd normally need WP CLI for. That's powerful. I'm excited about it. But it lands on a foundation that looks shaky.

Ben cohen

I'll push on that a little, Ido. The report doesn't say those agent tools are the problem. It says the basics are neglected. 55.9 percent of sites leak their WordPress version through the generator meta tag. 93.2 percent are missing at least one modern security header, and the report names HSTS, CSP and X Frame Options. The line that stuck with me is, defaults from a 2015 web are still the default in 2026.

Nick d

Right, and let's separate fact from interpretation. The fact is those percentages. My interpretation is that the leaked version and missing headers aren't a breach on their own. They're a signal of how much attention a site gets. When it comes to security, a site that never had a header review probably never had an update review either.

Ben cohen

I'd go further. If I were an attacker, or an attacker's script, a leaked version number is a free hint. It tells me where to start. Hiding it won't save you, but leaving it out in the open tells me nobody's looking after the place.

Ido

Hold on, though. Is that fair to agencies? A version tag takes one line to remove, sure, but headers like CSP can break a site if you rush them. Maybe that's why 93.2 percent haven't touched them.

Nick d

That's a fair point, and it's an explanation, not something the report states. Still, I'd call it a reason, not an excuse. You can roll out headers gradually, test them, and in just a few clicks in many hosting panels you can set the simple ones. The hard ones need a plan. The problem is that most agencies don't have a line item for it.

Ben cohen

And then core reminds us what's at stake. WordPress 7.0.2 shipped as an update everyone should install immediately. It addressed a REST API batch route confusion and SQL injection that could lead to remote code execution, reported by Adam Kues at Assetnote and Searchlight Cyber. There was also a related SQL injection issue reported by TF1T, dtro and haongo. If you're one of the 52.8 percent, or you're just late patching core, that's the week you find out.

Ido

So here's my sharper version of the question. Are we over indexing on the shiny agent layer and under investing in the boring layer? Because an agent with PHP execution on an unpatched site is a very short story.

Nick d

I'd answer that carefully. The agent tools aren't the villain. Novamira describes itself as free and open source, and the Ahentic AI preview from Benjamin Intal runs on just WordPress and its new APIs, with no external servers or MCPs. Fewer moving parts is a security story I like. But the more power you hand an agent, the more the surrounding hygiene matters. Patch first, then give it the keys.

Ben cohen

I'd say the order is the whole point. Audit your plugins, fix the headers, hide the version, update core, and then experiment with agents on a staging site. If you do it the other way around, you're building a faster car on a cracked road.

Ido

Now the second half, because plugin risk isn't just about patching. It's about who's actually maintaining the thing. Envato announced that from July 1, 2026 it moves to a flat 50 percent author fee and ends the exclusive author model, where selected authors paid a lower fee. Vova said going independent is inevitable. Xaver said the marketplace model feels dated. Lawrence Ladomery asked if it's time to sell direct.

Nick d

My take is that this changes the economics of maintenance. Fewer margins means authors ask whether the marketplace is worth it. If they go independent, they own support, updates, licensing and billing. That's more work, but also a direct relationship with customers. Done well, that's a game-changer for quality.

Ben cohen

Or it makes things worse, Nick. Think about the abandonment data. A report from WP Goldmine looked at 57,383 plugins in the WordPress.org directory. In the 10K to 100K active install band, 24 percent haven't been updated in over two years. That's 1,209 plugins with real users and no maintainer. If more creators pull away from marketplaces and some quietly stop, that pile could grow. That part is my speculation, not something the data says.

Nick d

Fair, but a marketplace never guaranteed maintenance either. Those abandoned plugins sit in the official directory, not Envato. Independent sellers at least have revenue tied to keeping customers happy. If nobody pays you, you stop updating. If people pay you directly, you have a reason to patch.

Ido

Then there's the branding side. Liquid Web retired the StellarWP umbrella and moved all those products under its own name. Some plugins keep their names, others are rebranded or merged into other plugins. Trust is the real question. Does a conglomerate name make me trust a plugin more, or less?

Ben cohen

Honestly, it depends on who maintains it behind the logo. A big company can fund security reviews. It can also merge a plugin into another and leave you with a migration headache. The name changes, but the question stays the same. Who answers when something breaks?

Nick d

So my checklist is practical. Before you install, check when the plugin was last updated, who owns it now, and how they handle security reports. After you install, track it. Streamline your process with a plugin list, an update schedule and a staging test.

Ido

And my closing thought is that AI makes this more urgent, not less. Agents can install plugins, edit files and run PHP. If we want that future, the unglamorous work of patching, headers and maintainer trust has to come first. Otherwise the 52.8 percent number just gets more expensive.

Ben cohen

Agreed. Fix the boring things this week. It's the cheapest security upgrade you'll make all year.