A new analysis has revealed a significant security gap within the global web ecosystem. Over 70% of publicly accessible WordPress sites are running outdated, end-of-life (EOL) PHP versions, significantly increasing their vulnerability to cyberattacks.
These findings highlight a systemic issue in how organizations manage their backend infrastructure, particularly given that WordPress remains the leading content management system (CMS), powering over 40% of all websites and more than 59 million publicly accessible instances as of June 2026.
The research from Censys examined over 316,500 WordPress deployments with visible version data and found that only 30% were using supported PHP versions.
The majority were relying on deprecated releases, such as PHP 7.4, which reached EOL in November 2022. In contrast, WordPress core updates appear to be applied more frequently; approximately 31% of sites are running supported versions, including WordPress 6.9, but only 14% are on the latest release, WordPress 7.0.
WordPress and PHP version exposure
| Metric | Value |
|---|---|
| Publicly visible WordPress instances (June 2026) | 59 million+ web entities |
| WordPress instances with visible PHP/WP headers | 316,500+ sites |
| WordPress sites on latest WordPress (7.0) | ~44,000 (14%) |
| WordPress sites on supported WordPress (6.9 or higher) | ~99,000 (31%) |
| WordPress sites on current PHP patch | ~94,000 (30%) |
| WordPress sites on outdated PHP | >70% of observed population |
| Most common PHP version observed | PHP 7.4 (EOL Nov 2022) |
This discrepancy suggests that administrators focus on updating the front-end CMS while neglecting the underlying PHP runtime, creating a critical security blind spot.
Using outdated PHP versions creates a high-risk attack surface due to unpatched vulnerabilities, the absence of security support, and potential compatibility issues with modern security defenses.
As PHP underpins the WordPress theme and plugin ecosystem, any weaknesses at this level can affect the entire application stack. Attackers are actively exploiting this gap, targeting legacy environments that are easier to compromise on a large scale. This issue is not limited to WordPress but reflects broader trends across CMS-driven infrastructure.
One key reason for delaying PHP upgrades is operational friction. Site owners often cite concerns about breaking functionality, plugin incompatibility, and complex migration paths as barriers to updating.
PHP’s upgrade model, which assumes incremental version transitions, complicates the process for systems running significantly outdated versions. As a result, many organizations postpone updates indefinitely, effectively running with known vulnerabilities in their production environments.
The growing reliance on plugins exacerbates the problem. As of mid-2026, nearly 7.5 million WordPress sites use plugins, with popular tools like Yoast SEO installed on over 5 million of them.
However, patching practices are inconsistent; less than 22% of Yoast users are running the latest version. Plugins introduce additional attack vectors, often with weaker oversight and a history of critical vulnerabilities.
For example, widely used plugins, such as UpdraftPlus, have faced multiple high-risk CVEs, including authentication bypass and data exposure flaws. Threat actors also exploit the plugin ecosystem through supply chain attacks, backdoored updates, and malicious clones of legitimate software.
The real-world consequences of these weaknesses are evident in ongoing attack campaigns, such as the “Hacked By MR.GREEN” defacement operation. Active since at least 2020 and continuing into 2026, this campaign has compromised over 900 websites, primarily WordPress-based CMS deployments.
These attacks typically exploit outdated software and misconfigurations, including exposed xmlrpc.php endpoints, publicly accessible install scripts, and unsecured SSH services. Security telemetry shows continuous scanning activity targeting these vulnerabilities, with at least 70 IPs observed probing WordPress XML-RPC interfaces in recent months.
Interestingly, the MR.GREEN campaign does not seem to pursue financial gain or data exfiltration; instead, it focuses on website defacement, replacing content with attacker signatures.
Despite its simplicity, this campaign highlights how low-sophistication threats can achieve widespread impact when basic security hygiene is neglected. In many cases, multiple minor issues, such as outdated PHP, unpatched plugins, and weak access controls, combine to create easily exploitable environments.
These findings reinforce a crucial industry message: maintaining CMS security requires equal attention to both application and infrastructure layers. Regular PHP updates, proactive plugin management, and secure configuration practices are essential for reducing exposure.
As attackers continue to automate large-scale reconnaissance and exploitation on a large scale, even minor maintenance lapses can rapidly escalate into full compromises.
Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…