Why plugins are your WordPress site's biggest security risk

In 2025, researchers found 11,334 new security holes in WordPress software, and 91% of them were in plugins. Here's what that means for a professional firm's website.

WordPress itself is rarely the problem. In 2025, researchers at Patchstack recorded 11,334 new security holes in the WordPress ecosystem, 42% more than the year before. Of those, 91% were in plugins, 9% were in themes, and only six were in WordPress itself.

Why plugins are different

A WordPress plugin runs with the same access as WordPress. If one plugin has a flaw, it can expose everything: your pages, your user accounts, and the messages people send through your forms.

Attackers know this, and they move fast. For the most heavily targeted flaws, Patchstack found a median of five hours between public disclosure and attacks. And 46% of the vulnerabilities had no fix available on the day they were announced.

What that looks like in practice

Contact forms readable by strangers. In December 2025, and again in July 2026, flaws in Ninja Forms, a plugin used on more than 500,000 sites, let visitors who weren't logged in read submitted form entries under certain conditions.
Email logs used to take over sites. In late 2025, attackers exploited the Post SMTP plugin to read sites' logged emails, including password-reset links, and take over administrator accounts.
Old bugs in popular plugins. In October 2024, Jetpack fixed a bug dating back to 2016 that let any logged-in user read visitors' contact-form submissions.
A compromised official download. In July 2025, copies of Gravity Forms downloaded from the vendor over about two days contained a backdoor that could create administrator accounts.

Why this matters more for law firms and CPAs

For a professional firm, a leaked intake form isn't just embarrassing. ABA Formal Opinion 483 says lawyers must notify current clients when their confidential information was, or may have been, accessed in a breach. Tax preparers covered by the FTC Safeguards Rule must report a breach involving 500 or more people's information to the FTC within 30 days of discovering it.

What you can do

Remove plugins you don't use, and consolidate ones that overlap.
Keep everything updated, and test updates before they reach your live site.
Don't keep sensitive form submissions stored on your website longer than you need to.
Consider a platform where add-ons run in a sealed sandbox with only the permissions they need, so a flaw in one can't take over your whole site.

Want to know how exposed your site is? Request a free savings audit. We'll list every plugin you run and what it would take to retire it.