WordPress plugins are, without a doubt, one of the best things about the CMS. They enable near-endless capabilities, turning a platform meant for blogs into a multifaceted powerhouse.
Plugins, however, also represent the largest attack surface across the WordPress ecosystem. In a single week in April 2026, researchers logged 185 vulnerabilities, 161 of which were found in plugins. Not in the WordPress core or its themes, but the plugins that provide critical functionality to websites.
That’s just one stat, but it’s a strong example of where the WordPress security conversation is at in 2026. And with AI now in the mix, from mass-creating less secure plugins to identifying vulnerabilities much faster, we expect that number to increase.
If you are running a WordPress website or managing them for clients, this number is worth keeping in your head when choosing plugins. Read on to learn more about why that is, what new threats have emerged in 2026, and how to avoid them.
Why are plugins the biggest attack surface?
WordPress core is, by any reasonable measure, remarkably secure. It makes sense. The platform has been around for twenty-three years, under constant public scrutiny. Combine that with a mature security team and a defined disclosure process, and you have a CMS that, as far as its core files are concerned, is genuinely hard to crack.
The ecosystem built on top of it, though, is a different story, and that’s where the security issues live.
As much as plugins extend what WordPress can do, they also extend its attack surface. After all, every plugin you install is, at its core, code that’s running on your server. It’s written by a third party, maintained on their schedule, and subject to their security practices (or lack thereof).
It’s the duality of WordPress's open-source nature and its plugins that is immensely beneficial but can also be catastrophically harmful. If you’ve worked with WordPress plugins, you are familiar with the constant tug of war: a plugin ships with a bug, an attacker finds it, and it gets patched.
In 2026, that model is still true. Keep everything patched, and you are mostly fine. However, it’s no longer the whole story.
The three new threat patterns
In 2026, three new threat vectors have made a significant impact, adding further complexity to what is already a long list of security measures and considerations.
Supply chain attacks: the plugin you trust might not be the one you expect
Many of you might be familiar with the Essential Plugin portfolio. It was a collection of over 30 legitimate WordPress plugins with hundreds of thousands of installations.
In 2025, the entire Essential Plugin business was quietly sold but continued operating as normal. Then, in April, 2026, it was discovered that all the plugins in the portfolio, more than 30, had been infected with malicious code.
The code granted the attacker a backdoor into all sites using these plugins and had sat dormant for months. When it was activated, it injected SEO spam only visible to crawlers.
All of this was done under the guise of routine compatibility updates, never once earning suspicion from its users. But the technical details matter less than the underlying failure here.
When the plugin changed ownership, its reputation transferred as well, and WordPress.org had no idea it had happened; they don’t track ownership changes. The five-star rating and the five years of clean history were quietly applied to the new owner, and users couldn’t have known.
This wasn’t a conventional breach. Buying these plugins allowed the attacker to bypass all security measures a site and its server may have, because the trust users placed in that purchase was built into it.
We also discuss this story on our April 16, 2026, Office Hours livestream, where Nathan Ingram, our agency coach, offers valuable insight.
Compromised update channels: even trusted updates can be dangerous
Another incident in April 2026 (the month must be cursed) showed that even well-established, trusted plugins can be compromised.
The plugin in question is Smart Slider 3 Pro by Nextend. An infected version of the plugin was pushed through the official update channel by an unauthorized party and remained live for about six hours before it was caught.
Six hours isn’t a long time, but Smart Slider 3 Pro has more than 800,000 installations. As you can imagine, in this case, six hours was plenty.
While the lesson here is uncomfortable, that even reputable plugin vendors can suffer a breach, keeping plugins updated is still the right advice. We’ll show you how to audit and update your plugins the right way a bit later in this blog.
Vibe-coded plugins: AI-generated code with no security review
AI has made it possible for almost anyone to make a working WordPress plugin by just describing it in plain English. That’s genuinely useful but also hides a major security problem.
Many of these AI-generated plugins are shipped with no support structure, no awareness of WordPress coding standards, and no security review. One agency reported finding 100 distinct security issues in a single vibe-coded plugin.
The attack surface on such plugins is immense. That’s why plugins created with AI still require a security overview by a human before anything goes into production.
The traditional threats haven’t gone away
All three scenarios we described above are in addition to the original threats we are familiar with. The list just keeps growing.
To give you a recent example, in January 2026, the popular Ninja Forms – File Upload plugin shipped a version without a way to properly validate the uploaded file types. In other words, it allowed an unauthenticated attacker to upload arbitrary files and achieve remote code execution.
A few weeks later, the vulnerability was patched, and everything returned to normal. This just goes to show why updating your plugins is still the best and most underrated defense in WordPress security.
What WordPress 7.0 changes about plugin security
WordPress 7.0 (launching May 20, 2026) introduces something significant for plugin security: the Connectors API. Site owners can paste API keys for AI providers (Anthropic, Google, and OpenAI ship by default) once in the WordPress dashboard, and every AI-enabled plugin on the site can use those credentials through a standardized interface.
For everyday use, this is excellent. One key per provider, no more configuring AI plugins one at a time. But for plugin security, it introduces a new shape of risk:
One compromised plugin can use ALL the AI credentials on the site, not just its own.
WordPress core doesn't yet have per-plugin usage tracking or spend caps.
API keys stored via the Connectors screen aren't encrypted in the database by default (ticket #64789 is tracking this).
The cost of a compromized plugin is higher now. Beyond your site data, AI credentials let attackers run up bills against your account, request by request. We've already seen the predecessor of this pattern with cryptojacking plugins that quietly mined cryptocurrency on customer servers. The next iteration is the same idea, but with API credentials that have direct dollar value attached.
With that in mind, here are three things you can do to ensure that doesn't happen.
Set spending caps on your AI provider dashboards (Anthropic, Google, OpenAI all support this) BEFORE pasting any API key into WordPress.
For higher-security setups, the Connectors API supports environment variables and PHP constants as higher-priority sources than the database. Use those where you can.
Treat AI-enabled plugins with the same scrutiny as any other plugin. The vetting checklist below applies to them the same way.
With those habits in place, the next thing is to decide which security plugins are worth installing. Fortunately, we've curated a list for you next.
The security plugins worth installing
After talking about vulnerabilities and threat patterns, let’s finally take a look at the plugins meant to counter them. It’s not an exaggeration to say there’s no shortage of WordPress security plugins. You’ll get ten thousand results if you type in security in the plugin directory. So what should you choose?
Here’s a list of the security plugins we chose as the best of 2026. Each will meaningfully improve your site’s protection, but running more than one is inadvisable. That’s likely to cause conflicts and performance overhead.
Wordfence: The most widely deployed WordPress security plugin. It includes an endpoint firewall, a malware scanner, a live traffic monitor, and a login security toolset, all directly on your server. Its free tier is genuinely useful, while premium adds real-time firewall rules that update as new threats are identified. It also uses machine learning to identify novel threats faster than signature-based tools can. Best for those who want an all-in-one protection managed directly from the WordPress dashboard.
Patchstack: This plugin takes a different approach. It focuses on vulnerability intelligence and virtual patching. In other words, it applies protections for known plugin vulnerabilities before the devs have shipped a fix. It also uses AI to classify and prioritize vulnerabilities. It’s particularly well-suited for agencies managing multiple client sites, where staying on top of every CVE manually isn’t realistic.
Sucuri Security: Boasting the strongest incident response, this plugin operates as a cloud WAF, sits in front of your site, and offers a malware removal service. The AI-assisted threat detection happens in the cloud layer, but the plugin is also great for sites that need immediate malware assistance, or businesses where incident response and malware removal matter as much as prevention.
Jetpack Protect: This is the lightweight security plugin. It offers free brute-force protection and vulnerability scanning with minimal overhead. It’s best for websites that don’t need a full security suite or can’t afford the resource overhead that some other plugins demand.
Solid Security Pro: Formerly iThemes Security, this plugin focuses less on AI features and instead prioritizes hardening basics: two-factor authentication, file change detection, login protection, and locking down common attack vectors. It's a thorough plugin and an excellent choice for the non-technical site owner.
MalCare: This one is worth considering if server resource usage is a concern. Instead of using server resources for scans, it runs them in the cloud and offers one-click malware removal. It’s less comprehensive than Wordfence, but more suitable for a shared hosting environment.
We didn’t want to just give you six plugins that do the same thing, that’d wouldn’t tell you much. Instead, each of these plugins does something different from its peers and excels at what it does.
If you are not using a managed host that handles server and network security, the practical pick for you would be Wordfence or Patchstack as the primary security layer. If your host doesn’t offer any hardening, Solid Security Pro will cover that. For agencies, Patchstack might be the better option, as it offers a multi-site dashboard.
AI-powered features sound impressive on paper, too, but do they really hold up in practice? We asked Andrés López of the LATAM Content and Website team about the AI capabilities of Wordfence and Patchstack, and he agreed they can be invaluable:
While "AI" is a huge trending buzzword, these tools genuinely offer great value. Their "Learning Mode" allows them to become increasingly accurate at detecting threats over time. Just keep in mind that this advanced protection usually comes with a higher server resource consumption.
And if your host does offer server and network security (more on that a bit later), then all you’d need is Solid Security Pro. It can handle application-layer security (2FA, login protection, etc.) while your host handles the rest.
How to vet a plugin before you install it
Now that you know which security plugins we recommend, what if you want to audit them yourself? Or any plugin for that matter. How do you ensure that incidents like the ones we described earlier don’t affect you, or that the plugin is legit?
Before diving into the full checklist, here’s how Andrés himself approaches it instinctively.
Before I hit install, I always verify four things: Is the developer well-known? Is the update history consistent? Does the support team actually reply? Most importantly, am I downloading this directly from the official provider? If it’s from a third-party site, there’s a high risk the code has been tampered with.
That’s a solid, four-step plan that should be anyone’s baseline. We’ve further expanded on it in this practical, actionable list that takes no more than five minutes to complete. It should provide you with valuable information to help you make an informed decision about whether to use the plugin. That’s one of the most meaningful ways to reduce risk.
Check active install count: Anything under 5,000 installs is worth additional scrutiny. It’s not a disqualifying factor, but dig a little deeper.
Last updated date: A plugin that hasn’t been updated for more than six months should have a good reason for that. Check the support forums and ensure the developer is still active. A good indicator is if there are open bug reports without a response.
Ownership history: While WordPress.org doesn’t flag ownership changes directly, you can watch for a few signals. These aren’t definitive, but worth pausing on:
Sudden shift in writing style or tone in the changelog.
Fresh author account on an established plugin.
Significant version jump with vague release notes.
Rating trend: An overall high rating with a bunch of new, low-rated reviews often indicates that ownership, quality, or support responsiveness has changed.
Author reputation: Is the author a known developer or company? Do they have a track record? Or is it a fresh account with a single plugin and no visible history?
Open repository: This one is vital. Does the plugin have a public GitHub repo or another way to examine the code before downloading it? Does the repo have active maintainers? The code should, ultimately, be reviewable.
Security disclosure process: This is especially important for paid plugins. Does the vendor have a published security policy? Do they communicate vulnerabilities responsibly when they are found? These things are vital for proving to users that the plugin is trustworthy.
In addition to the list above, a thing to watch in 2026 is the Abilities API. WordPress 6.9 introduced the server-side version, which lets plugins expose actions to AI agents in a standardized way. WordPress 7.0 adds the client-side JavaScript counterpart, plus the Connectors and WP AI Client infrastructure that sits on top. Useful, and a new surface area to watch. Plugins without tight permission scoping are worth scrutinizing carefully as this ecosystem matures.
AI cuts both ways
We already mentioned how AI-generated plugins are generally a risk. However, it would be a mistake to let you walk away from this blog, thinking AI is purely a threat to WordPress security.
When used well, it’s one of the most practical defensive tools available right now. AI can excel at catching novel threats. Pattern recognition across a large install base can identify behavioral anomalies that a hand-written ruleset might miss.
In addition, the ability to ask an AI-assisted tool questions in plain English has made scanning through logs a legitimate, fast-paced diagnostic tactic. If something feels off on a site, feeding an AI logs and asking it to identify potential problems can save a lot of time spent manually or on command-line searches.
Finally, while AI will definitely write security-lacking code, it’s also capable of identifying those issues. While we do not recommend relying entirely on AI to audit code, as a human professional's check is still far superior, it’s a good way to filter out obvious problems in minutes.
In 2026, those who handle plugin security well all use AI actively on the defensive side. Yes, AI has enabled poorly coded plugins to flood the internet, with malware potentially lurking among the lines, but it also allows users to detect those flaws and mitigate them. Especially when combined with a good hosting foundation.
Where managed hosting fits in
Managed hosting (WordPress or not) has become a significant layer in website and plugin security in 2026. It’s worth noting what it actually contributes and how it handles threats at the server, network, and application levels.
Most plugin security conversations happen at the application layer: the firewall plugin, the malware scanner, the update policy. However, a good managed host operates further up the stack than that.
It should all start at the network level, with security provided by a CDN. That way, every request must first pass through their protections. That way, any malicious traffic (DDoS attempts, known bad actors, exploit probes) is evaluated and blocked before it even reaches the server. That way, WordPress doesn’t need to deal with it.
From there, the protection should extend to the server level through a firewall, or even two. Why two? Because they each cover different parts of the overall stack and address different issues.
Malware detection.
Suspicious file changes.
Server-side intrusion attempts.
Volumetric attack mitigation.
Known exploit pattern identification and prevention.
None of this would slow down your site either, since it’s handled by the server and the CDN. It has no impact on your site's performance.
Hosts that offer full-page caching through a CDN also have an added security benefit. Because most requests are served from the edge rather than the origin (the server), the likelihood of server-level exploits succeeding is much lower to begin with.
This is why, when it comes to a managed host that fully covers server- and network-level protection, Nathan recommends Solid Security Pro. It doesn’t try to do things the host already does; instead, it complements it.
Andrés also elaborated further on how managed hosting can help:
Managed hosting makes a massive difference. It offers curated blocklists, preventing users from installing high-risk plugins. It also has proactive protection and WAF, shielding users from malicious traffic before it even reaches your website. It won't protect you from the consequences of installing pirated plugins or critical misconfigurations, though. It's a partner in security, not a total replacement for good site hygiene!
A practical 2026 checklist
To round out this blog post, we’ve put together a practical security checklist for 2026. This should give you a solid foundation for a secure website.
Keep core, plugins, and themes updated. Highly recommended that you do it via staging first.
Run the newest possible version of PHP (8.4 or 8.5 right now). Anything older is end-of-life and creates both security and compatibility risk. WordPress 7.0 specifically drops support for PHP 7.2 and 7.3, so sites on those versions stay on the 6.9.4 branch with security updates only.
Install the right security plugin(s). Don’t overlap features. Check with your host what security they provide, and complement it with a plugin.
Run a quarterly plugin audit: list every active plugin, check last updated date and ownership signals, and remove anything that isn't actively needed.
Set spending caps on your AI provider dashboards (Anthropic, Google, OpenAI all let you cap monthly spend) BEFORE pasting any API key into WordPress 7.0's Connectors screen. Core doesn't have native spend tracking yet.
For higher-security setups, prefer environment variables or PHP constants for AI API keys over the Connectors screen, since the screen stores keys in the database without encryption by default.
Before installing anything new, run the vetting checklist we showed you earlier.
Harden wp-config.php: correct file permissions, file editing disabled.
Monitor wp-config.php for unauthorized changes. This specifically catches the Essential Plugin class of supply chain attack.
Use AI-assisted tools for log analysis and code review as part of your regular workflow, not just when something goes wrong.
Run a tested backup restore plan that someone has actually run end-to-end to verify it works. Just having the backups is not enough.
For agencies: document a plugin review policy for client sites. It doesn't need to be long. It needs to exist and be followed consistently.
This list should give you a great starting point for ensuring your site is safe. We encourage you to add items to it as needed, based on your specific situation.
What all of this means for your site
The good news is that WordPress security in 2026 isn’t harder than in previous years. It’s just different now. The measures are all still relevant: updates, strong passwords, a firewall, etc.
However, supply chain attacks and compromised update structures are threats that no single plugin can catch. They require a broader framework: careful selection before installation, ongoing monitoring, and infrastructure-level defenses that underpin it all.
A clear plugin selection and vetting process, a solid audit framework, and managed hosting for server and cloud-level monitoring and protection are a combination that still holds well. It just needs the few additional steps in this blog post. Alone, they are insufficient, but together, they cover the realistic threat surface.
