In this article, we’ll explain why many old vulnerabilities in WordPress are still being exploited, even in the age of AI-driven security.
Even in the AI era, many of the vulnerabilities targeted in WordPress are outdated
According to Patchstack, only four of the top 10 most targeted WordPress vulnerabilities were disclosed in 2025.
This aligns with our own attack detection statistics.
The vulnerabilities currently being targeted the most, as detected by our company, are listed below.
■ Attacks targeting relatively recently discovered vulnerabilities
admin-ajax.php?action=pods_admin
Pods Plugin: Issues involving arbitrary file manipulation and information leakage were reported in older versions, exploiting AJAX actions that could be called without authentication (CVE-2026-19598, disclosed August 15, 2026)
admin-ajax.php?action=wdpsso_step1
WP Dashboard / SSO-related plugins: Attacks targeting authentication and permission checking flaws in AJAX handlers in older versions (CVE-2026-76581, disclosed August 28, 2026)
■Attacks targeting previously discovered vulnerabilities
admin-ajax.php?action=the_grid_load_more
The Grid plugin: Input validation flaws in load_more-related AJAX handlers (SQLi/local file inclusion). Affects older versions.
/wp-content/plugins/mypixs/mypixs/downloadpage.php
MyPixs Plugin: Arbitrary file reading via the `url` parameter in ` downloadpage.php` (directory traversal/LFI). A typical goal is to obtain `wp-config.php` and other files
Other Top Attacks
It is worth noting that malicious attacks such as those listed below are among the top 10 attacks detected by our company.
These attacks target files that do not originally exist on WordPress.
In other words, they are believed to be attacks that attempt to reuse malicious files (malware) planted by other hackers.
/wp-content/plugins/seoplugins/db.php
/wp-content/themes/pridmag/db.php
/wp-content/themes/seotheme/db.php
/wp-content/plugins/apikey/apikey.php
/wp-plain.php
To summarize, the statistics break down as follows:
Attacks targeting recently discovered vulnerabilities: 20%–30%
Attacks targeting other vulnerabilities: 20%–30%
Attacks targeting backdoors and similar elements planted by other hackers: 40%–50%
Why do these attack patterns emerge?
It is believed that this is because most hackers attempting to hack WordPress are not highly skilled; even with AI, they cannot devise effective attack methods. Therefore, it is still easier for them to target older vulnerabilities for which hacking tools are already widely available—the easiest targets—or to target sites that have already been hacked by other hackers.
What is an effective vulnerability countermeasure?
Given this, if your site has been compromised, it is crucial to completely remove the malware as soon as possible.
Additionally, for most WordPress sites that have not yet been compromised, it is important not to leave major vulnerabilities—the ones that make it easiest to compromise a site—unaddressed for long periods of time (*).
* Hackers use tools to launch widespread attacks against vast lists of WordPress sites obtained from search engines and other sources, systematically targeting vulnerabilities that make sites the easiest to compromise. If successful, they consider it a windfall and proceed to hack the WordPress site.For this reason, if major vulnerabilities are left unaddressed for an extended period, the probability of your site falling victim to a hacker’s attack increases over time.
We hope you found this information helpful.
This page prohibits the use, quotation, or summarization of any page, in whole or in part, by the Generated AI. However, if the following conditions are met, the specification of content using generated AI is permitted.
1. it is not for the purpose of learning by the generated AI. 2. only the summary or title of the page content at a level that does not lead to the solution of the user’s problem is shown to the user. 3. in the case of 2, a link to this content is shown to lead the user to this page.
