¿Prefiere leer este artículo en español? → Seguridad de WordPress en la era de la IA
If your business has a website, there is a very good chance it runs on WordPress — the same software behind everything from your neighborhood bakery's menu page to large online stores. For years, the security story was familiar: keep things updated, use a decent password, and you were ahead of most trouble. What changed in the last year is who finds the weak spots first, because now it is artificial intelligence, and it works at a speed no human team can match. This article explains why AI is finding so many WordPress flaws, what that means for your site, what WordPress itself is doing about it, and how to choose the best WordPress security plugin from the three leading options.
The size of the target explains the attention. WordPress runs 40.8% of all websites [W3Techs, August 2026] — four sites out of every ten, which makes it the single biggest prize on the internet for anyone hunting for a way in.
AI can now find WordPress security holes for the price of lunch
At a security conference this May, researchers showed what happens when you point modern AI at WordPress plugins. Their system read plugin code, guessed where the weak spots were, and then tested its own guesses on throwaway copies of real sites, and in 72 hours it confirmed more than 300 critical zero-day flaws — a zero-day being a hole nobody knew existed, so nobody had built a fix [Help Net Security, 2026]. The cost worked out to about $20 per flaw, which means finding a serious website hole now costs less than lunch for two. Checking one of those flaws by hand takes a human expert 30 to 60 minutes.
The flaws are almost never in WordPress itself. Patchstack, a company that tracks WordPress security, counted 11,334 new vulnerabilities in 2025, a 42% jump over the year before, and 91% of them lived in plugins — the add-ons your site uses for forms, bookings, and payments [Patchstack, 2026]. The WordPress core software had just six, a number small enough to show where the real risk sits. Plugins are written by thousands of separate developers with very different levels of care, and AI reads through all of that code without getting tired.
Attackers move within five hours, and almost half of the flaws have no fix
Speed is the part that should change how you think about protection. Patchstack measured a median of five hours between a flaw becoming public and attackers trying it at mass scale, which means the race is usually over the same business day. Roughly half of the high-impact flaws were attacked within 24 hours. Worse, 46% of the vulnerabilities disclosed had no fix available at the moment they became public, so "just update your plugins" was not even possible for nearly half of the problems. In the same research, hosting company defenses stopped only 26% of the attacks thrown at them. Waiting is not a plan.
Even the core software had its warning shot this summer. A researcher directed an AI model to audit WordPress core, and in about ten hours of machine time it pieced together a full attack chain, later named wp2shell, that let an outsider take over a site without logging in [XenoSpectrum, 2026]. WordPress shipped fixes in versions 6.8.6, 6.9.5, and 7.0.2 in July, and New Zealand's national cyber agency confirmed criminals were using the flaw three days after the fix came out. The lesson is not that WordPress is doomed. It is that the finding of flaws has been automated, and the defending has to be automated too.
WordPress is not standing still, and the free improvements are real
The platform has been quietly raising its own floor. Since October 1, 2024, WordPress.org requires two-factor authentication — a second login check beyond the password — for every developer who can publish plugin and theme updates, closing a door where one stolen password could poison thousands of sites at once [The Hacker News, 2024]. Version 6.8 replaced its old password storage with bcrypt, a slower, tougher method that makes stolen password files far more expensive to crack [WordPress.org, 2025]. Minor security fixes install themselves automatically on most sites, and the fast wp2shell patches showed the core team can move quickly when it matters.
Version 7.0, the newest major release, moves the same way. It raised the bar for the PHP versions it runs on, and it added one central, supervised channel for AI connections, so plugins do not each open their own door to outside AI services. Its security patches also keep landing fast: update 7.0.3 fixed 11 security bugs in one August release [WordPress.org, 2026], and some of them were found and reported by AI security teams — proof that the same technology attacking WordPress is now starting to defend it too.
All of that helps, and none of it solves the main problem. The core team can harden WordPress itself, but 91% of the flaws are in plugins the core team does not control. Protecting that layer is your job, and it is exactly the job the security plugins below compete for.
The three best WordPress security plugins, compared
Three names lead this market, and they protect you in genuinely different ways. Wordfence is a plugin that lives on your site, runs a firewall there, scans your files for malware, and can repair damaged files by comparing them with clean originals — its free version is solid but receives new firewall rules 30 days late, and the paid version costs about $119 a year. Sucuri takes the opposite approach: a cloud firewall that filters traffic before it ever reaches your server, bundled with a cleanup crew that removes infections for you, from about $200 a year. Patchstack plays a different game entirely — it watches the vulnerability lists, and when a flaw appears in a plugin you use, it ships a "virtual patch," a narrow blocking rule that closes that exact hole even if the plugin's developer never releases a fix, with a free alert-only plan and paid protection from about $15 a month.
| Wordfence | Sucuri | Patchstack | |
|---|---|---|---|
| How it protects | Firewall and scanner on your site | Cloud firewall in front of your site | Blocks known flaws in your plugins |
| Malware cleanup | Scan and repair tools | Done for you by their team | Not the focus |
| Virtual patching | No — general firewall rules | Partial — generic cloud rules | Yes — its core feature, per flaw |
| Free plan | Yes, rules delayed 30 days | Basic checks only | Yes, alerts only |
| Paid price | About $119 per year | About $200 per year | From about $15 per month |
| Best fit | One site, hands-on owner | Busy sites wanting cleanup done for them | Sites running many plugins |
Prices checked on August 14, 2026 (the day this article was written) and rounded — plans and tiers change often.
Why Patchstack fits the AI era best, and when the others still win
Match the tool to the threat. The threat we just described is thousands of plugin flaws found by machines, attacked within five hours, and unpatched 46% of the time — and Patchstack is the only one of the three built precisely for that shape of problem, because a virtual patch closes the hole without waiting for the plugin developer to wake up. Wordfence still earns its place when you want one plugin that also scans and repairs files on a single site you manage yourself. Sucuri is the right call when your site is a revenue machine and you want infections cleaned by someone else while a cloud firewall absorbs the junk traffic. For most small businesses running a dozen plugins, though, the hole that gets you will be a known one that nobody patched in time. Patchstack exists for exactly that hole.
There is also a fourth path worth naming: make it your host's problem. Our WordPress hosting plans build the security layer in — malware detection and removal, automatic WordPress updates, daily backups, and free SSL certificates — starting at $9.99 a month, which is less than most of the plugins above on their own. If your site already lives elsewhere and moving it is not on the table, our website security service adds monitoring and cleanup around whatever setup you have.
Close the five-hour window before it closes on you
The deeper principle is simple: flaw-finding has become automatic, so your defense has to be automatic too, because no owner of a bakery, law office, or online store is going to read security bulletins at 2 a.m. Pick one layer — a virtual patcher, a firewall, or hosting with security built in — and let it update itself. If you'd like a plain answer on which layer fits your site, send us the address and we'll take a look — no proposal attached.
Sources
Written from Patchstack's State of WordPress Security in 2026 whitepaper, Help Net Security's report on AI-discovered WordPress plugin vulnerabilities (2026), XenoSpectrum's analysis of the wp2shell WordPress core attack chain (2026), the WordPress core team's note on bcrypt password hashing in 6.8 (2025), and The Hacker News on mandatory two-factor authentication for plugin developers (2024).
