How to Read a WordPress Vulnerability Report and Patch Fast

For many serious WordPress vulnerabilities, the gap between public disclosure and active attacks is measured in hours. If your site waits days or weeks to update, it can be exposed during the window when attackers are most active. Knowing how to read a vulnerability report helps you decide in a few minutes whether you need to act today or whether the update can wait for your normal maintenance.

Below you’ll find what the numbers show, how to read a report, and a plan you can follow when the next advisory lands.

Why the patch window has shrunk to hours

The WordPress ecosystem produces a large and growing number of security flaws. In 2024, researchers found 7,966 new vulnerabilities, and 96% of them were in plugins. Wordfence counted even more in its own database: 8,223 published in 2024, 68% more than in 2023, with about 35% still unpatched.

The pace has not slowed. Patchstack’s 2025 mid-year report counted 6,700 new vulnerabilities in the first six months of 2025, rated 41.5% of them exploitable in real-world conditions, and found that most of those required no authentication. A 2026 compilation that cites Patchstack’s latest report lists 11,334 new vulnerabilities in 2025 and a median of 5 hours from disclosure to mass exploitation. Those are secondary figures that have not been checked against the original report, so treat them as indicative. They are consistent with what recent incidents have shown.

A real example: CVE-2026-87902

In September 2026, WordPress core itself was hit. CVE-2026-87902 is a path traversal flaw in page-template resolution with a CVSS score of 9.2 that, under certain conditions, lets unauthenticated attackers run code remotely. WordPress fixed it in version 7.1.2 on 22 September 2026 and patched every older branch back to 4.7, yet the first attacks came at 11:49 UTC that same day.

The attacks escalated quickly. Researchers watched them move from initial probing to attempts to write malicious PHP files and deploy web shells. One security company CEO pointed out that WordPress has auto-updates turned on by default. He expected mass exploitation attempts but relatively few actual compromises. The sites most at risk were the ones where someone had switched auto-updates off and nobody was watching.

How to read a WordPress vulnerability report

Most advisories from WordPress, Patchstack, Wordfence and similar sources follow the same pattern. Check these points in order:

1. Affected component. Is it WordPress core, a theme, or a plugin you actually have installed? Remember to include deactivated plugins, because their files still sit on your server.
2. Affected versions. Compare the listed range with the version on your site. If yours falls inside it, you are exposed.
3. Fixed version. Look for “patched in” or “fixed in.” If no fixed version is listed, see the section below on unpatched flaws.
4. Authentication required. “Unauthenticated” means anyone on the internet can attempt it, so it should move to the top of your list. Flaws that need an administrator login carry less risk on a site with few accounts.
5. Vulnerability type. Remote code execution, SQL injection and file upload flaws can lead to a full takeover. Some cross-site scripting issues are narrower in scope.
6. CVSS score. This gives you a quick severity rating (explained next).
7. Exploitation status. Phrases like “actively exploited” or “exploitation attempts observed” mean you should act now, not at the next maintenance window.

What a CVSS score does and doesn’t tell you

CVSS is maintained by FIRST and rates severity on a 0.0–10.0 scale. Low is 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9 and Critical 9.0–10.0. The current version, CVSS v4.0, was released in November 2023.

A score describes how bad a vulnerability could be, not how likely it is to be exploited. That distinction matters because 81% of the vulnerabilities Wordfence published in 2024 scored Medium. Don’t ignore a Medium score if the flaw is unauthenticated and sits in a plugin you rely on. Combine the score with the authentication and exploitation details before you decide how urgent it is.

When there’s no patch yet

Sometimes the fix doesn’t exist yet. According to Patchstack’s 2025 report, more than half of the plugin developers it contacted in 2024 did not release a fix before public disclosure. Some plugins are never fixed at all. In 2024, 1,614 plugins and themes were removed from the WordPress repository over unpatched security issues, and abandoned plugins are not flagged to users, even when they are removed for security reasons. Your dashboard may simply show “no updates available” while the plugin stays vulnerable.

If a flaw is unpatched, you have three options:

• Deactivate and delete the plugin until a fix ships, if your site can run without it.
• Replace it with an actively maintained alternative.
• Use a web application firewall or virtual patching service that blocks the specific exploit. For a business-critical site, talk to a professional about this option.

A patch-speed plan you can follow

1. Keep core auto-updates on. As the CVE-2026-87902 case showed, this default protects most sites. Only turn it off if someone is reliably updating by hand.
2. Keep an inventory. List every plugin and theme with its version, and note when each was last updated by its developer.
3. Subscribe to an alert source. Use a vulnerability feed or security plugin that checks your installed components against known flaws.
4. Triage by the checklist above. Treat unauthenticated High or Critical flaws with signs of active exploitation as same-day work.
5. Take a backup, then update. A fresh backup lets you roll back if an update breaks something.
6. Prune regularly. Remove unused plugins and themes. Every one you delete is one less thing to patch.

Patching isn’t the finish line

If your site was exposed before you updated, the patch closes the door but won’t remove anything an attacker already left behind. After CVE-2026-87902, administrators were told to install the patched versions and also check their sites for signs of compromise. Check for these signs:

• Unfamiliar PHP files, especially in upload folders
• New administrator accounts you didn’t create
• Changed files in core, theme or plugin directories
• Unexpected redirects, spam pages or outbound links

If you find any of these, cleanup is usually a job for an experienced professional. A partial cleanup can leave a backdoor in place.

Why it helps to have someone watching

When attacks start within hours, the hard part is noticing the advisory, judging how serious it is and acting before attackers reach your site. That is difficult for a business owner to do on top of everything else. Hoke Designs is a family-owned studio in Juneau that has designed websites since 2007 and offers managed hosting. Having someone knowledgeable look after your site’s security means advisories get read and acted on promptly. If you’re already a client, our support desk at support.hokedesigns.com is the place to ask about a specific vulnerability report.

Key takeaways

• Serious WordPress flaws can be exploited within hours of disclosure, so how fast you patch matters.
• Read each report for the affected component, versions, fixed version, authentication, type, CVSS score and exploitation status.
• CVSS measures potential severity, not likelihood. Unauthenticated, actively exploited flaws come first.
• Many flaws have no patch at disclosure, and abandoned plugins aren’t flagged, so remove or replace them.
• Keep core auto-updates on, back up before updating, and check for compromise after a high-risk patch.

If you’d like help keeping your site patched, call (424) 209-8199 or send a message via the contact form, and a person will reply within one business day.

Images are presented for illustration purposes only.We use real photographs when we need to show what was happening at a real event.