WordPress powers 40.7% of all websites, according to W3Techs data from September 2026. That’s more than eight times the market share of its nearest competitor.
Yet many people still picture WordPress attacks the same way: a hacker finds a weakness, installs malware, and a scanner catches it later.
That view is increasingly out of date.
One of the most damaging WordPress vulnerabilities today doesn’t involve malware at all. It’s called broken access control, and it often flies under the radar because there’s no malicious file, virus, or suspicious script for a scanner to detect.
Broken access control may sound technical, but the concept is simple. Every action on a WordPress site should start with a permission check to verify that the user is authorized to perform it.
A subscriber shouldn’t be able to change site settings. A contributor shouldn’t be able to publish content without approval. Administrators should have capabilities that lower-level users do not.
When a developer forgets to add a permission check—or implements it incorrectly—a low-privileged user may gain access to features they should never be able to use. In some cases, an unauthenticated visitor can access those features, too.
No malware gets installed.
The website simply accepts an action request from someone it should have rejected.
According to Patchstack’s 2025 WordPress security research, broken access control was the most exploited category of WordPress vulnerability.
It ranked ahead of threats many site owners pay far more attention to, including malware and brute-force login attacks.
The report identified 11,334 new vulnerabilities across the WordPress ecosystem during the year. That represented a 42% increase over the previous year.
WordPress recently started using AI-assisted scanning to catch flaws like privilege escalation and cross-site scripting in core before release, which should keep that already-small number even smaller, but the plugin layer where most access control bugs actually live has no equivalent safety net.
Plugins were responsible for 91% of reported vulnerabilities, while themes accounted for 9%. WordPress core itself contributed fewer than 1% of the total, with just six low-priority issues that were patched quickly.
Traditional malware scanners are designed to identify known malicious code. They compare files against malware signatures and look for suspicious changes.
That approach works well when a backdoor, spam script, or web shell has been planted on a website. It doesn’t work nearly as well when the problem is a missing permission check.
There is no malicious file to find.
The site’s own code is behaving exactly as it should. The problem is that the settings are granting access to the wrong person.
Timing also makes these vulnerabilities especially dangerous. Patchstack found that 46% of vulnerabilities were still unpatched when they were first disclosed publicly.
The median time between disclosure and mass exploitation was roughly five hours. About half of all exploited vulnerabilities began facing attacks within the first 24 hours.
A scanner that runs once a day—or once a week—is unlikely to keep pace with that timeline. Even worse, many scanners were never designed to detect this type of flaw in the first place.
Imagine a plugin that allows site owners to export contact form submissions. Before generating that export, the plugin should verify that the request is coming from an authorized administrator.
If that permission check is missing, anyone who discovers the correct URL may be able to download the data. They might not even need to log in.
Nothing has been “hacked” in the traditional sense. The feature is simply doing its job for someone who should never have had access.
Now multiply that possibility across thousands of plugins built by different developers with different levels of security experience. It becomes much easier to understand why this vulnerability category appears so frequently.
The good news is that WordPress already includes tools that can limit the impact of these vulnerabilities. Its role-based permission system is designed specifically to control access.
The principle is straightforward.
Give users only the permissions they need to do their jobs. When accounts have fewer privileges, vulnerabilities typically have a smaller impact.
For example, if a contributor account is compromised, an attacker can only perform actions available to contributors. If that user had unnecessary administrator permissions, the potential damage would be much greater.
Strong access management goes beyond assigning the correct user roles. Simple, rudimentary security habits matter just as much.
Every person who needs access should have their own login account. Shared administrator accounts make accountability harder and turn one compromised password into a site-wide problem.
The default “admin” username is also worth removing or renaming.
Because it is one of the most commonly targeted usernames, eliminating it removes an easy first guess for automated attacks.
Other recommended practices include using strong, unique passwords, storing credentials in a password manager, enabling two-factor authentication, and limiting repeated failed login attempts.
Together, these measures create additional barriers that many automated attacks are not designed to overcome.
Access control is only one piece of the WordPress security puzzle. Outdated software remains one of the most common causes of website compromises.
When plugins, themes, or WordPress core installations remain unpatched, attackers can take advantage of vulnerabilities that already have public fixes available. Keeping WordPress security updated helps close those windows of opportunity.
Automatic updates can significantly reduce risk. Maintaining regular backups before major updates provides an additional safety net. If an update causes a problem, recovery is much faster and less disruptive.
Security plugins still have an important role to play. Malware scanning, firewalls, and brute-force protection add valuable layers of defense, even if they cannot detect every broken access control issue.
This is also where managed WordPress hosting can help, as many providers include automatic updates, backups, security monitoring, and other protective features at the hosting level, reducing the maintenance site owners need to handle.
Building a stronger security foundation does not require advanced technical knowledge. It mostly comes down to following a handful of proven best practices.
A solid checklist includes assigning each user the minimum permissions necessary, avoiding shared logins, removing or renaming the default admin username, and requiring strong passwords with two-factor authentication.
It should also include automatic updates, reliable backups, and security tools that form part of a layered defense strategy.
None of these steps are particularly complicated.
They simply require treating WordPress permissions and access controls as important security settings rather than background options that rarely get reviewed.
Many conversations about WordPress hosting security still revolve around malware. Site owners often ask whether a scanner is running, whether a firewall is enabled, or whether the site has been infected.
Those questions are important, but they can pull attention away from the vulnerability category causing some of the most significant damage across the WordPress ecosystem.
Broken access control doesn’t always look like an attack.
To a site owner, everything may appear to be functioning normally. The difference is that the site is functioning normally for the wrong person.
That subtle distinction is exactly what makes broken access control so dangerous. It is also why it deserves far more attention than it currently receives.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…