The real problem is not the vulnerability — it is the 23%

Security articles always end the same way: "update to the latest version." Sound advice — and yet incidents keep happening, long after the fix has shipped.

The 2026 figures explain why.

1. Three numbers

• WordPress plugin vulnerabilities disclosed — more than 250 per week
• Exploitable without authentication — 43%
• Still unpatched thirty days after disclosure — 23%

Start with the first. Two hundred and fifty a week is more than thirty-five a day. A typical site carries ten to twenty plugins, so the odds of one of yours appearing on the list in any given week are far from remote.

The second: 43% do not require a login at all. However long and complex the administrator password, it is not consulted.

And the third is the subject of this article.

2. What 23% actually means

Disclosure means the method becomes public too. With July's core vulnerability, mass scanning began the moment working exploit code appeared.

So the period between disclosure and update is time spent with a publicly documented door left open. For roughly one site in four, that period runs past thirty days.

Vulnerabilities usually get fixed within days. What does not get fixed is the site.

3. Why the update does not happen

It is not negligence. In practice there are three reasons.

Nobody owns it

There was an agency during the build. Once the site was delivered, that relationship ended, and the site became something you call about when there is a problem. A vulnerability does not announce itself as a problem. It simply sits there, open.

Updating has become frightening

Anyone who has once updated a plugin and watched the layout break stops touching them. "It works right now, leave it alone." That instinct is rational: the breakage is certain and immediate, while the security risk is invisible.

It is unclear what needs updating

The dashboard says "3 updates available" without saying which is a security fix and which is a new feature. Applying all three feels risky; applying none feels worse.

4. Do automatic updates solve it?

Half of it. WordPress applies core security releases automatically, and in July 2026 the severity was such that forced auto-updates were switched on. That is unambiguously good.

But automatic updating has limits.

• A conflict with a theme or plugin breaks the page — and days pass before anyone notices, because updates typically land overnight
• An abandoned plugin has no fix to install. What is needed there is not an update but a decision: replace it or remove it
• Configuration-based vulnerabilities are not fixed by updating at all — the missing webhook signature in the Stripe case being a good example

Automatic updates take over the clicking. The deciding and the checking remain.

5. What is actually required

Three things. None of them difficult — but all of them continuous.

• Once a week, match the vulnerability list against the plugins on your site
• Make the site restorable before updating, and look at it afterwards
• Treat abandoned plugins as cleanup, not as pending updates

A business owner cannot realistically take this on; there is a business to run. Hiring someone in-house means an annual salary several times the cost of the website itself.

6. How THEVOS handles it

We include one year of maintenance at no charge after launch, and the three items above are part of it. The reason is simple: the period after the build is the longer one.

Our own CMS, VosCMS, builds features as in-house modules inside the core rather than as third-party plugins, so what needs updating does not scatter, and fixes do not wait on someone else's release.

None of this makes WordPress a poor choice. It is the most widely used platform in the world for good reasons, and run properly it performs well. The point is that "run properly" contains a weekly, repeating task — and that who performs it should be decided at the start, not discovered later. That is what the 23% is telling us.

Sources — 2026 WordPress plugin vulnerability statistics; IPA advisory (22 July 2026); WordPress.org forced auto-update (July 2026)