What are the countermeasures when the era of AI attacking WordPress arrives?

Here, we’ll explain how to prepare for the era when AI starts attacking WordPress.

Can AI Hack WordPress Sites?

It is difficult for major AI systems (such as ChatGPT, Claude, and Gemini) to attack WordPress sites.
This is because these AI systems have built-in safeguards that prevent them from generating such requests or malicious code.

However, there are examples of open-source models (such as Llama, Mistral, and Qwen) that can be run locally and are susceptible to “jailbreaking”—a process that removes the provider’s security safeguards after the fact.
Modified or specialized versions of these models, with little to no security measures in place, are also circulating.

However, this does not mean that AI can successfully hack any website—not even now. Existing security measures remain effective even in the AI era.
I will explain this point in more detail.

WordPress Hacking Countermeasures Required in the AI Era

With the spread of AI, the reality is that attacks on WordPress sites are less about “new attack methods” and more about the “automation and sophistication of existing attacks.”
In other words, even with AI, the fundamental approach—exploiting existing, known WordPress vulnerabilities—remains unchanged; however, the speed and quality of these attacks may be increasing.

Generally, hackers hack WordPress sites following the process outlined below:

1. A vulnerability is discovered.

2. The hacker develops an automated tool to exploit that vulnerability.

3. The hacker obtains a list of several thousand—or in some cases, tens of thousands or more—WordPress sites.
*In some cases for step 3, hackers may exploit search engines to pinpoint and acquire only WordPress sites with specific vulnerabilities.

4. Using the tool from step 2, they launch attacks one after another on the WordPress sites from the list obtained in step 3. (Since there are a vast number of WordPress sites, they often simply exploit vulnerabilities regardless of whether the attack succeeds or fails.)

AI is likely to lower the barrier to entry for step 2 and make step 4 more efficient.

Regarding step 2, AI is now capable of creating vulnerability-exploiting tools based on publicly available vulnerability information and Proof-of-Concept (POC) documents—which detail the specific steps required for a successful attack—even without advanced technical skills.

As a result, it is highly likely that the time between when a vulnerability is discovered and when it is exploited to carry out a hack will continue to shrink.
Although there is currently little research on exactly how much this timeframe is shortening, Rapid has reported that the frequency of attacks exploiting vulnerabilities has more than doubled.

In the recent case of the “wp2shell” vulnerability discovered in WordPress, a PoC was circulating on GitHub within 48 hours of the release of the patch, and multiple security vendors observed actual attacks.

*However, since WordPress hacking attacks are carried out sequentially against the vast number of WordPress sites, this does not mean that such an attack will reach your company within 48 hours. Because there are so many WordPress sites, the list of targets is enormous, and the time required to work through that list sequentially is very long—this is a characteristic of WordPress hacking.
While the probability of being attacked increases over time, it is expected that this timeframe will continue to shorten

.

Consequently, based on our experience, we previously believed that sites with major unpatched vulnerabilities had a high probability of being hacked within six months; however, we now believe it is necessary to adjust this estimate to a shorter timeframe.

Security Measures for WordPress Sites in the AI Era

Security measures for WordPress sites in the AI era will involve identifying site vulnerabilities more quickly and addressing them promptly.

It is important to minimize the number of plugins and other components used on the site, to constantly monitor their vulnerabilities —either by checking online or using security plugins —and to repeatedly implement security measures, such as updates and patching vulnerabilities, as frequently as possible (once every one or two months).