Characteristics of WordPress Hacking Incidents and Attacks in the AI Era

Here, we’ll explain the characteristics of WordPress hacking incidents and attacks in the age of AI.

Now that AI is increasingly being used for hacking, what trends are emerging in attacks on WordPress sites?

Reference Site: WordPress Security Statistics for 2026

New WordPress vulnerabilities discovered in 2025: 11,334—a 42% increase from the previous year

We have entered an era where vulnerabilities are being discovered one after another by AI, without human intervention. It is likely that even more vulnerabilities have been discovered by AI this year.

Of the newly discovered WordPress vulnerabilities, 91% are caused by plugins

This shows that most vulnerabilities to watch out for in WordPress originate from plugins. Regularly checking for and staying aware of plugin vulnerabilities is a critical security measure.

Click here for plugins that can also perform vulnerability scans

For WordPress sites, security measures such as early detection of plugin vulnerabilities, updating plugins, and removing unnecessary plugins are particularly important.

Median time from vulnerability disclosure to a large-scale attack: 5 hours

Thanks to AI, the time it takes for hackers to turn vulnerabilities into exploitable tools (software that can be used for large-scale attacks) has been significantly reduced, meaning the time between a dangerous vulnerability being discovered and it being exploited in a large-scale attack has become extremely short.

*However, this does not mean that any site can be successfully hacked within 5 hours. There are hundreds of millions of WordPress sites, and there are significant hurdles and a time lag before a site with a vulnerability is targeted by hackers

.

Percentage of vulnerability exploitation attempts blocked by the security features of typical hosting environments: 26%

This figure indicates that the defense mechanisms of hosting servers are not very effective at preventing hacking.

Percentage of WordPress sites out of all websites: 44%

WordPress is the world’s most widely used website creation system. Currently, as much as 44% of all websites worldwide are built with WordPress.

Global average financial loss due to data breaches: $4.44 million

WordPress itself generally contains very little data beyond what is displayed on the website and does not store personal information (excluding e-commerce sites).

For this reason, administrator passwords and other credentials are encrypted, so even if WordPress data is leaked, it rarely results in personal information leaks that harm individuals.

However, according to “WordPress Security Statistics for 2026,”when a WordPress site shares a server with other systems containing personal information, hackers can exploit WordPress vulnerabilities to gain access to those databases, leading to the leakage of personal information from systems outside of WordPress. These incidents are driving up the total financial cost of personal data breaches.

The average financial loss from such incidents is reported to be $4.44 million.While these are U.S. statistics and it is likely that data breaches at large corporations are artificially inflating the average, we recommend thatyou do not host systems containing personal information on the same server as WordPress, and that you pay particular attention to security measures for e-commerce sites running WordPress that store personal information.

As such, starting in 2026, the likelihood of WordPress sites coming under attack will increase significantly. We strongly recommend that you pay even closer attention to your security measures.