The short answer
Patchstack’s 2026 report found 91 percent of new WordPress vulnerabilities in 2025 were in plugins and 9 percent in themes, with only six in core. The risk is the ecosystem, not WordPress itself. A custom site with no plugin marketplace, a static public front end and an admin hosted elsewhere removes most of that surface. Custom code still needs patching, as the 2025 Next.js and React advisories showed, but there is far less of it.
- Patchstack reported 11,334 new WordPress vulnerabilities in 2025, up 42 percent on 2024.
- Heavily exploited WordPress flaws were attacked within hours of disclosure, by Patchstack’s weighted median.
- Modern frameworks have critical bugs too; the difference is how many components you depend on.
- Whatever you run, patch within days and turn on two-factor sign-in everywhere.
Custom code vs WordPress at a glance
| What matters | Custom code | WordPress |
|---|---|---|
| Third-party code | A reviewed dependency list | Every plugin and theme installed |
| Public login | None on a static site | wp-login and wp-admin by default |
| Patch speed needed | Days for framework advisories | Hours for exploited plugin flaws |
| Monitoring | Dependabot and host alerts | Security plugin or WAF plus update watch |
What the 2026 numbers say
Patchstack’s State of WordPress Security in 2026 counted 11,334 new vulnerabilities in the WordPress ecosystem during 2025, a 42 percent rise on the year before. Plugins accounted for 91 percent, themes for 9 percent, and WordPress core for six individual issues. For heavily exploited flaws, the report puts the weighted median time to first exploitation at about five hours. Sources: Patchstack, State of WordPress Security in 2026
Why plugins are the problem
Plugins come from thousands of developers with very different security practices, and every one runs with full access to the site. Abandoned plugins stop getting fixes. Attackers scan the whole internet for a vulnerable version within hours of a disclosure, so a weekly update routine is already too slow for the worst cases.
Custom code is not a free pass
In March 2025 Next.js disclosed a middleware flaw that could bypass authorisation checks (CVE-2025-29927). In December 2025 a critical remote code execution flaw in React Server Components (CVE-2025-55182) affected apps using that feature. Teams that patched quickly were fine. Teams on frozen, unmaintained builds were exposed. Sources: NVD CVE-2025-29927, NVD CVE-2025-55182
How to shrink the surface
Serve public pages as static files where possible. Keep the admin or CMS on a separate domain behind single sign-on with two-factor. Keep dependencies few and well known. Turn on automated vulnerability alerts. Remove features nobody uses.
If you stay on WordPress
Keep under 15 well-maintained plugins, enable automatic updates for security releases, put a web application firewall in front, restrict wp-admin by IP or SSO, and subscribe to a vulnerability feed such as Patchstack or Wordfence. Sources: Patchstack, State of WordPress Security in 2026, Wordfence threat intelligence
Our verdict
If security is a board-level concern, a lean custom site is the easier platform to defend. If you keep WordPress, treat plugin updates as urgent operations, not a monthly chore.
Questions people ask
Is WordPress core secure?
Core had six new vulnerabilities in Patchstack’s 2025 count, against thousands in plugins. Core is not where most risk lives.
How fast do I need to patch?
For actively exploited flaws, within a day. Automated updates help.
Are custom sites hacked less?
They expose less third-party code and often no public login, which removes the most common attack paths.
No affiliate links on this page at publication. Product names link to official sites so you can check current pricing. How we work.
