Reasons Not to Use WordPress in 2026

In July 2026, security researchers published a pair of flaws in the WordPress software itself that, used together, let a complete stranger create their own administrator account on a site — no password, no login page, nothing (Rapid7, 17 July 2026). Not a broken add-on. Not a trick email. WordPress itself.

On 21 July, four days later, the U.S. cybersecurity agency CISA put both flaws on its list of weaknesses known to be used in real attacks. By then several ready-made attack scripts were circulating.

WordPress released fixes (versions 6.9.5 and 7.0.2) and forced them onto sites that had automatic updates switched on. Sites without them stayed open until someone updated by hand. And a site taken over this way may show nothing more than an admin account nobody remembers creating.

This wasn’t an isolated incident. 2026 was the year WordPress’s security record became impossible to ignore. And it’s not because WordPress got unlucky. It’s because of how WordPress is built.

The Year WordPress’s “Safe Base” Argument Died

For years, the standard advice was: WordPress itself is secure. It’s the plugins you need to worry about. Just keep everything updated and you’ll be fine.

In 2026, that advice stopped working. The safe base turned out to be the problem.

The July attack — researchers named it “wp2shell” — chained two flaws in the WordPress core, the main software that every WordPress site runs on. GitHub’s advisory rates it critical; the published severity score is 7.5 out of 10. The number matters less than this: it needs no account and no help from anyone on the site, which is the kind of flaw you fix the same day.

The result was that a stranger with no password, no admin access, and no special knowledge could take over a site entirely. They could lock out the real owner, install their own admin account, and do whatever they wanted with the site — steal customer data, inject malware, redirect visitors to scam pages, or use the site to attack other people.

What this means for you: You can’t rely on “WordPress itself is secure” anymore. The software that powers your website can be the entry point. And you won’t know until it’s too late.

The Attack Vector That Was Supposed to Be Safe

In April 2026, it came out that dozens of WordPress plugins sold by a company called Essential Plugin — things like sliders, galleries, and marketing tools — had been carrying a hidden backdoor. WordPress.org counted the affected plugins on more than 20,000 active sites; the seller itself claimed over 400,000 installs (TechCrunch, 14 April 2026).

Here’s the part that should worry you: the malware didn’t come through some shady download site. It came through the normal WordPress update system. The system that WordPress owners are told to trust. The system that automatically updates plugins when a new version is available.

Someone had bought the plugin business in 2025. Soon after, an update labeled as a routine compatibility check slipped in hidden code, which sat unused until April 2026 (Patchstack). Site owners who had clicked “update” had installed a hidden backdoor — a secret door that lets the attacker come back any time they want.

The malware wrote itself into the site’s most important configuration file. Then it followed instructions from a remote server: inject spam links, create fake pages, redirect visitors.

On 7 April, WordPress.org closed the plugins for good and pushed a forced update that tries to remove the backdoor. Patchstack lists changes to that configuration file among the signs of infection, so removing the plugin alone may not be enough.

What this means for you: The standard advice — “just keep your plugins updated” — was literally the attack vector. Hackers used the update system itself to deliver malware. You can’t trust the very mechanism you’re told to rely on.

It Happened Again Two Months Later

In June 2026, it happened again, through a different door. Attackers got into the update system ShapedPlugin uses for its paid “Pro” plugins and slipped in code that stole admin logins and two-factor secrets, giving them full access to sites. The free versions on WordPress.org were not touched (Aardwolf Security, 23 June 2026).

Two incidents in three months, the same idea both times: poison an update channel, wait for site owners to click “update,” and walk in.

This is what security researchers call a “supply-chain attack.” The malware rode in through a normal software update — the update itself was poisoned. It’s the digital equivalent of buying a locked safe, and the manufacturer having a key they didn’t tell you about.

What this means for you: You are not just trusting the plugin developer. You are trusting their update system, their security practices, their company’s ownership history, and their supply chain. That’s a lot of trust to place in a company you’ve never met, for software you probably got for free.

Niche Sites Are Targeted Too

If you think your small real-estate site or local site is too small to be a target, January 2026 proved otherwise.

RealHomes CRM, a plugin that comes with a popular theme for real-estate sites, had a flaw that let anyone with even the most basic account on the site upload harmful files and take it over. It was installed on more than 30,000 websites (Infosecurity Magazine, 22 January 2026). The fix came in version 1.0.1, and every site that hadn’t installed it stayed open.

What this means for you: If you’re in a specific niche — real estate, legal, medical, any field with specialized tools — you’re not safer. Niche plugins have far fewer people looking at their code than the big, popular ones, so a flaw can sit there for longer. And attackers know where those plugins are used.

Your Hacked Site Becomes a Weapon Against Your Visitors

The scariest story of 2026 didn’t come from a vulnerability disclosure. It came from security researchers at Check Point, who uncovered a criminal operation called StopAndProtect (report of 18 August 2026).

The operation was built on close to 2,000 hacked WordPress websites. The criminals used these sites as infrastructure: hosting malware, controlling infected computers, storing stolen files, screenshots, and victim logs.

The operators’ own records listed around 2,000 compromised WordPress domains. More than 6,000 victim IP addresses. Around 31,000 victim screenshots collected. More than 700 archives of stolen data.

And here’s what the researchers found when they investigated why these sites were so easy to compromise: one site in the operation had been running the same WordPress version since 2021 — nearly five years old — with around 40 known security holes.

The criminals didn’t just use the hacked sites to store their stolen goods. They used them to infect the sites’ own visitors. A visitor would land on a hacked WordPress site and see a fake “prove you’re human” check. It told Windows visitors to run a command on their computer, and that command installed the criminals’ software: on some computers, ransomware that locks every file.

What this means for you: An unmaintained WordPress site doesn’t just hurt you. It becomes a weapon against the people who visit your site. Your customers, your potential clients, your neighbors. If your site is hacked and used to infect visitors, that’s a trust you can never get back.

The Structural Problem No Update Can Fix

Every 2026 incident was either:

• A flaw in a third-party plugin the owner didn’t know about and couldn’t assess
• An update channel the owner was told to trust
• Or — once — the WordPress core itself

In every case, the owner had to act within hours of a news story they almost certainly never saw.

And that’s the structural problem. A WordPress site is not a document. It’s a running program — with dozens of third-party parts, each maintained by a different company, each updating on its own schedule, each a potential entry point for attackers.

Who is the security team for a WordPress site you run yourself? In practice, it’s often you — even when you don’t realize it.

Managed WordPress hosting exists, and it helps. Companies like WP Engine, Kinsta, and SiteGround handle server-level security, push automatic core updates, run daily backups, and scan for known malware. For many people, that’s a real improvement over managing it alone.

But managed hosting doesn’t solve the structural problem. The 2026 attacks came through ordinary updates — the same updates managed hosts install for you. When Essential Plugin and ShapedPlugin shipped malware through plugin updates, a managed host had no reason to block them. When the WordPress core had a critical flaw, managed sites were open until the patch landed, same as everyone else. And no managed host audits the code inside every plugin you install. The decision to trust a plugin — its developer, its ownership history, its entire supply chain — is still yours.

These attacks are engineered for that weakness. They exploit the fact that a plumber, a baker, a salon owner, or a small-town lawyer does not have time to monitor security news, audit plugin code, and investigate suspicious admin accounts — and that paying for managed hosting doesn’t fully close that gap.

WordPress can absolutely be secured. Large enterprises do it — with dedicated security teams, managed hosting, custom plugin auditing, and round-the-clock monitoring. But for one person running a site, that level of vigilance is unrealistic.

The Honest Alternative: What a Static Website Does Differently

So what’s the alternative?

A static website is a set of pre-built files — pages that are already created and just get sent to your visitor’s browser. There is no running program, no database, no login page, and no plugins.

Let’s be honest about what that means:

What WordPress does well — and why you might want it:

• A huge ecosystem of themes and plugins
• A familiar editing interface
• The ability to add complex features without hiring a developer
• A massive community of designers and developers who know it

What a static website gives up:

• You can’t log in and edit pages directly — changes are made by whoever builds the site (with the sites we build: you send the change and we make it; small edits are free in the first month, then €20 each, plus VAT)
• You can’t install a plugin on a whim — adding features requires your developer
• You can’t run a complex e-commerce store or membership site — those need dynamic functionality

What a static website gives you in return:

• No login page for attackers to target — there’s literally nothing to log into
• No plugins to exploit — there are no third-party parts to compromise
• No database to steal — there’s no database
• No update channel to poison — there’s nothing to update on the server

Plugin flaws, poisoned updates, core vulnerabilities — the attacks that hit WordPress sites all through 2026 have nothing to reach on a static site. Not because the static site has better security. Because the static site doesn’t have the parts that get attacked in the first place. Stolen passwords still matter: someone who gets into your hosting or domain account can change the site, which is why two-step login on those accounts is the one lock you shouldn’t skip.

That’s not a claim that static sites are unhackable. Nothing connected to the internet is truly unhackable. But a static site removes the attack surface — the places where hackers typically get in.

For a plumber, a baker, a salon owner, a local law firm — a static website often covers everything the site has to do: a fast, professional site that tells people who you are, what you do, and how to contact you. It does that without requiring you to be a part-time security administrator.

How Exposed Is Your Site? A 30-Second Checklist

Take 30 seconds and answer honestly:

• ☐ My site runs WordPress
• ☐ I have 5 or more plugins installed
• ☐ I don’t know when I last updated them
• ☐ I don’t know who my security person is
• ☐ I learned about any of the 2026 incidents in this post

If you checked three or more boxes, your site is exactly the kind of target the 2026 attackers went after. Not because you’re careless — because the system you’re using demands more vigilance than anyone should need.

Conclusion

2026 was the year the WordPress security argument changed. The safe base turned out to be vulnerable. The update channel turned out to be an attack vector. And thousands of websites were caught in the crossfire, used as tools in criminal operations their owners never knew about.

This isn’t about fear-mongering. It’s about facing a simple truth: a WordPress site requires constant security vigilance that is unrealistic for one person to maintain. A static website removes the parts that get attacked — and in doing so, removes the burden of being your own security team.

If your website exists to tell people who you are and what you do, you don’t need a running program with dozens of third-party parts. You need published files that are fast, safe, and boring — in the best possible way.

Related: What Is a Static Website and Why You Might Want One — the full explainer on how static sites work and what they can’t do.

Related: Why Your WordPress Site Keeps Breaking — the maintenance problem, from crashes to constant upkeep.

Is your WordPress site a worry? We rebuild WordPress sites as static ones, at a fixed price, after a free look at your current site. Your old page addresses redirect to the new pages.

See how a redesign works →