When a WordPress site gets hacked, the instinct is to blame WordPress. Most of the time the core software is not the way in. The way in is a plugin or theme that was out of date, abandoned, or both. Understanding why that is the leading path to infection tells you almost everything you need to know about keeping a site clean.
Every plugin is code you did not write
WordPress core is maintained by a large, security-conscious team and updated promptly. The plugins and themes bolted on top of it are a different story. Each one is code written by someone else, running with real access to your site, and maintained on its own schedule, or not maintained at all. Plugins are the most common source of WordPress vulnerabilities, and the reason is simply volume: a typical site runs many of them, and every one is another door.
The problem is rarely that a plugin is malicious. It is that it is old. A plugin that has not been updated in a year may have a known weakness that was fixed upstream but never applied on your site, or worse, was never fixed because the author walked away.
How a known flaw becomes a mass hack
Here is the pattern that plays out again and again. A researcher finds a vulnerability in a popular plugin and reports it. The author releases a fix, and the flaw is assigned a public identifier, a CVE. That disclosure is good and necessary, but it also hands attackers a map. Within hours, automated tools are scanning the whole web for sites still running the vulnerable version.
- A flaw is found in a widely installed plugin.
- A fix ships, and the vulnerability is documented publicly.
- Attackers automate scans for sites that have not updated yet.
- Every unpatched site is exploited at scale, without anyone targeting you personally.
You are not singled out. You are simply found. The attack is indiscriminate, which is what makes an outdated plugin so dangerous: you do not have to be interesting, you just have to be behind. An abandoned plugin is worse still, because there is no fix coming at all. The vulnerability stays open for as long as the plugin stays installed.
Reducing your surface
The good news is that this is one of the more controllable risks in WordPress. Fewer moving parts means fewer doors. A short, deliberate plugin list that you actually keep current is far safer than a long one full of things you installed once and forgot.
- Remove plugins you no longer use, do not just deactivate them.
- Check when each plugin was last updated before you trust it.
- Replace abandoned plugins with maintained alternatives.
- Apply updates promptly, especially for anything public-facing.
None of this is complicated. It is just consistent, and consistency is exactly what slips when a site is busy and no one owns the maintenance. That is the case for a WordPress support partner rather than another plugin: someone whose job is to own the maintenance so it does not slip.
When the door was already open
Sometimes the scan finds you before the update does. If a site has been compromised through an old plugin, adding a new security plugin will not undo it. The infection has to be cleaned: the site restored from a known-good backup, credentials rotated, and the vulnerable component removed or replaced so the same door cannot be used twice.
You do not have to be a target to be a victim. Automated scanners do not care who you are, only which version you are running.
That is the work our malware cleanup service is built for: engineer-assisted recovery for when a plugin has already let something in. No scare tactics, just a clean path back and someone who has seen the pattern before. The best outcome, of course, is never needing it, and that starts with keeping your plugin list short and current.