WordPress runs somewhere near half of all websites, which is exactly why it gets attacked so relentlessly. Automated bots scan the internet around the clock looking for outdated plugins, forgotten themes and misconfigured settings, and they do not care whether the site behind them belongs to a hobby blogger or a company turning over seven figures a year. The scale of the platform is precisely what makes it such an efficient hunting ground.
The core is solid, the extras are not
WordPress itself, maintained by a large and active community, gets patched quickly when problems surface. The trouble sits one layer up, in the tens of thousands of third-party plugins and themes that site owners install to add functionality. Many are built by small teams or solo developers who move on, stop updating, and leave a piece of code sitting on your server with a known vulnerability and no one left to fix it. A site can be running the very latest WordPress core version and still be wide open through a contact form plugin nobody has touched in years.
A thorough round of web application pen testing treats your WordPress installation the way an attacker would: mapping every plugin, checking for outdated versions, testing input fields for injection flaws, and looking at how the admin panel is exposed. It is not unusual for a site with twenty or thirty active plugins to be carrying two or three genuinely serious weaknesses without anyone realising, often in features nobody on the current team even remembers installing.
How a single plugin becomes a full compromise
A vulnerable plugin rarely stays contained. Once an attacker finds a flaw that allows file uploads or database queries, they typically use it to plant a web shell, giving them a persistent foothold regardless of what happens to the plugin afterwards. From there they can deface the site, redirect visitors to malicious pages, harvest customer data, or quietly use your server to send spam and host phishing pages under your domain’s good reputation. Search engines are quick to blacklist a compromised domain, and getting removed from that blacklist afterwards can take far longer than fixing the original flaw ever would have.
William Fieldhouse has watched this pattern play out often enough to have a clear view on where it starts.
“I have lost count of the WordPress sites we have tested where the front page looks pristine and the back end is a graveyard of plugins nobody has opened in three years. The client always assumes the risk is the code they wrote. It almost never is. It is the code they installed and forgot.”
– William Fieldhouse, Director of Aardwolf Security Ltd
That forgetting is the crux of it. Plugins get added for a campaign, a feature request, a one-off integration, and then they sit there indefinitely, still active, still connected to the database, still a viable entry point long after anyone remembers why they were installed. A site audit that only checks the pages visitors see will miss all of this entirely, because the plugin causing the problem may never appear on a single page a visitor actually loads.
Treat your plugin list like an asset register
The fix is not to abandon WordPress; it is to manage it properly. That means a genuine inventory of every plugin and theme in use, a schedule for updates, and the removal of anything inactive. Pair that housekeeping with periodic vulnerability scan services so you catch what internal reviews miss, and you turn a soft target into a hardened one. Get in touch with Aardwolf Security to have your WordPress site tested properly before someone else finds the gap first.
