WordPress and Magento Security in 2026: Why We Now Recommend Migrating Urgently

WordPress powers a huge share of the web, and that popularity has made it the single biggest target for attackers. 2026 has made things markedly worse. In July a flaw chain called wp2shell let anonymous attackers take over WordPress sites through the core software itself, and it was exploited within days. In October came PHP2Shell: two critical flaws in PHP, the language WordPress and most other CMS platforms run on, which put the servers behind an estimated 70% of websites at risk and were under attack within days of the fix.

In our experience the risk has risen significantly since then. Keeping clients safe has become a daily battle: new vulnerabilities in WordPress plugins and themes are disclosed almost every day, attackers exploit them within hours, and keeping a typical site patched has become a never-ending job that costs more effort than the site justifies.

This is not only a WordPress problem, and it is not only about the WordPress software. A website is a stack of parts: the server, the PHP version, the CMS core, every plugin and the theme. Any one of them can let an attacker in. Below we show how sharply critical vulnerabilities have risen this year, explain what a hacked website really costs and where the risk sits, compare 15 common web platforms, and set out why we now treat migration as critical.

Critical vulnerabilities have rocketed in 2026

The rise is not just a feeling. Across all software, the number of newly published vulnerabilities rated critical (CVSS 9.0 to 10.0) climbed from around 400 a month at the start of 2026 to more than 1,500 a month from August onwards. The 9,864 critical CVEs published between January and October 2026 are roughly two and a half times the 3,978 published in the whole of 2025.

416Jan

415Feb

619Mar

553Apr

666May

927Jun

1,313Jul

1,811Aug

1,554Sep

1,590Oct

PHP2Shell shows why this matters to website owners even when their own CMS is fully up to date. The two flaws, CVE-2026-109618 and CVE-2026-109619, sit in PHP itself and let an attacker run code on the server without logging in. PHP released fixes on 21 October 2026, but Amazon's threat intelligence team had already recorded an exploitation attempt four days earlier, and CISA added both flaws to its Known Exploited Vulnerabilities catalogue on 26 October. Two days after the fixes, the PHP team warned of a further flaw that can also be used for remote code execution.

Updating WordPress does nothing to fix PHP2Shell. The server's PHP version has to be updated, and PHP 7.3 and older versions have no fix at all.

What a hacked website really costs a business

Many business owners assume that if their website doesn't hold customer data, a hack doesn't matter much. It does. Most compromised sites are not defaced or taken offline. They are quietly taken over and used in the background, often for months before anyone notices.

• Your site used for crime. Attackers use hacked sites to host phishing pages, spread malware, send spam, mine cryptocurrency and attack other systems, all under your domain name and on your hosting.
• Your visitors attacked. Injected code can silently redirect visitors to scam sites or push malware onto their devices, so the people who trust your site become the next victims.
• Your domain blacklisted. Once that activity is spotted, browsers can show visitors a red warning instead of your site, search engines can flag or drop your pages, email providers can block mail from your domain, advertising platforms can suspend your ads, and your host can suspend the account. Repairing a domain's reputation can take weeks.
• Your search rankings wrecked. A common hack quietly adds thousands of spam pages for gambling, drugs or counterfeit goods to your site. Search engines index them, and the rankings you built can take months to recover.
• Customer and business data stolen. Contact form submissions, customer accounts, orders and the site's database can all be copied, along with internal business data and any passwords stored there. In the UK, a personal data breach may need to be reported to the Information Commissioner's Office within 72 hours, and US businesses face state breach-notification laws.
• Payment and invoice fraud. Attackers can change the bank details shown on your website, invoices or payment pages, or inject code that skims card details at checkout, so customers pay the criminals instead of you.
• Your email turned against you. A breached site often stores email credentials or leads to them. From a compromised mailbox, criminals send convincing messages from your real address, typically asking customers or suppliers to "update" the bank details they pay.
• A way into the rest of your business. Websites hold passwords, API keys and connections to payment, CRM and email systems, and staff often reuse passwords. One hacked site can lead to the systems behind it, and to every other site on the same server.
• Ransom and extortion. Attackers can encrypt or delete the site and its backups, or threaten to publish stolen data unless you pay.
• Hacked again after the clean-up. Attackers usually leave hidden backdoors behind. Unless every one is found, the site is compromised again weeks later, and the clean-up bill comes twice.
• Legal, card-payment and insurance problems. A breach involving card data can lead to forensic investigation and penalties under card-industry rules, customers can make claims, and an insurer may question a claim if the breach came through software that had a known fix.
• Financial and reputational loss. Downtime, lost sales, clean-up costs, regulatory action and damaged customer trust almost always cost far more than securing the site would have.

WordPress vulnerabilities are rising every year

Patchstack coordinates more WordPress vulnerability disclosures than any other organisation, and its figures show the scale of the problem. Its State of WordPress Security in 2026 report logged 11,334 new vulnerabilities across the WordPress ecosystem in 2025, a 42% rise on the year before.

4,528

2022

5,948

2023

7,966

2024

11,334

2025

Two other findings from the same report matter even more than the total. The weighted median time from disclosure to first mass exploitation was just five hours, and 46% of vulnerabilities had no fix from the developer when they were made public. By the time most site owners hear about a flaw, automated attacks are already running, and for nearly half of them there is nothing to install yet.

This year's figures are worse again. Patchstack's database has already logged 11,640 WordPress vulnerabilities in 2026, more than in the whole of 2025, and the core software is no longer the safe exception it used to be.

Plugins still account for the overwhelming majority of what is found, which is why removing them matters more than any single update.

10,479Plugins

1,108Themes

53Core

It is not just WordPress: the four layers that put your website at risk

When people talk about WordPress security they usually mean the WordPress software itself. In practice the core is the smallest part of the problem. A site is only as secure as the weakest of these four layers, and each one has its own developers, its own update cycle and its own vulnerabilities.

Abandoned plugins and paid-for updates

Many plugins are maintained by a single developer or a small company. When they lose interest, sell up or stop trading, the plugin stops receiving security fixes but keeps running on thousands of sites. One Bitdefender analysis found that nearly 30% of critical vulnerabilities in WordPress plugins are never patched at all.

Premium plugins and themes add a second trap. Security updates are usually tied to an annual licence, so a site whose licence has lapsed quietly stops receiving fixes. Patchstack also notes that premium components get less scrutiny from researchers because their code is harder to access, so flaws can sit undiscovered for longer. Sites running "nulled" (pirated) copies to avoid the licence fee are worse still, as these are a common way of spreading malware.

Even a trusted developer can become the way in. In 2022 attackers backdoored 93 themes and plugins from AccessPress Themes at the source, so site owners who updated in good faith installed the backdoor themselves.

The server and PHP version underneath

WordPress, Magento, Joomla, Drupal and Craft CMS are all built on PHP. Each PHP version receives security fixes for a limited time, and after that any new flaw in PHP itself is never fixed. Many sites stay on old versions because upgrading would break outdated plugins or themes. That leaves them trapped: the plugins can't be updated without breaking the site, and the server can't be updated without breaking the plugins. PHP2Shell turned that trap into an emergency, because a site that cannot move to a fixed PHP release has no complete fix available.

The same applies to the database, the web server and the hosting control panel. On shared hosting, a compromise of a neighbouring site or of the panel can reach every site on the machine. This is why we treat website hosting as part of a site's security, not a separate commodity.

Magento, Joomla, Drupal and other platforms face the same pressure

WordPress is the biggest target because it is the most common, but every widely used platform is now probed constantly. The flaws below were all exploited in real attacks in 2025 and 2026, and several were added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalogue.

• Magento and Adobe Commerce. Online shops hold payment data, which makes them high-value targets. After a flaw known as PolyShell was exploited from March 2026, security firm Sansec reported that 56.7% of exposed stores had already been compromised. A later zero-day called StyleSmuggler was used to breach more than 3,800 stores in a matter of weeks.
• Joomla. Mostly through extensions. Critical flaws in the iCagenda and Balbooa Forms extensions and in the JCE editor were exploited in 2026, with iCagenda attacked as a zero-day from June.
• Drupal. Core flaws are rare, but a highly critical SQL injection (CVE-2026-9082) affecting all supported versions was disclosed in May 2026 and exploited soon after.
• Craft CMS. A maximum-severity code injection flaw (CVE-2025-32432) has been used to install cryptominers and other malware on unpatched servers.
• Sitecore. Enterprise sites were attacked through a deserialisation flaw (CVE-2025-53690) that lets attackers run code without logging in on installations using an exposed ASP.NET machine key.
• Next.js and React. Modern JavaScript sites are not exempt. React2Shell, rated the maximum CVSS score of 10.0, allowed unauthenticated code execution through React Server Components, and default Next.js projects were vulnerable.

Our risk rating for 15 web platforms

To help businesses prioritise, we have rated 15 common website platforms against WordPress, which is set at 100% as the benchmark. This is our own relative assessment, not a measured statistic. It combines how many vulnerabilities each platform produces, how often they are exploited in real attacks, and how many sites are exposed. A lower score means lower relative risk, not no risk.

Rank	Platform	Main weak point	Risk score
1	WordPress (including WooCommerce)	Plugins and themes, plus the wp2shell core flaw in 2026	100%
2	Magento and Adobe Commerce	Core and extensions; repeated mass compromise of online shops	90%
3	Joomla	Third-party extensions exploited as zero-days	70%
4	Drupal	Rare but serious core flaws, such as the 2026 SQL injection	60%
5	Next.js and React	Framework-level flaws such as React2Shell	58%
6	Sitecore	Deserialisation flaws allowing code execution without login	55%
7	Craft CMS	Core and underlying framework; maximum-severity code injection	52%
8	Adobe Experience Manager	Large backlog of vulnerabilities, mostly cross-site scripting	45%
9	PrestaShop	Third-party modules and card-skimming attacks	42%
10	vBulletin	History of remote code execution flaws in the core	40%
11	TYPO3	Extensions; the core is relatively solid	32%
12	OpenCart	Extensions, slow patching and card skimmers	30%
13	Liferay	Enterprise portals with past exploited code execution flaws	28%
14	Progress Sitefinity and Telerik	Long-exploited flaws in the Telerik UI components	25%
15	Headless CMSs (Strapi, Directus, Payload)	Newer and smaller targets; API and authentication flaws	18%

Why we now recommend migrating to secure custom code

Patching remains essential on every platform. For WordPress in particular, though, the work needed to keep a typical site safe no longer makes sense for most businesses. It means watching disclosures daily, testing and applying updates within hours, replacing abandoned plugins, chasing expired licences and keeping PHP current without breaking anything. The site is a target because of the platform it runs on, not because of anything the business has done.

A custom-built site removes most of that attack surface. There is no public plugin marketplace, no third-party theme framework and no widely known codebase for automated attacks to scan for. Only the features the site actually needs are built, so there is far less code that can go wrong. Through our website design service we rebuild sites in custom code with a custom admin backend, matching the existing design and usually improving it, so visitors and staff see a better version of the site they know.

Custom code is not a replacement for good practice. It still has to be written securely, hosted on supported software and kept up to date, which is why we pair custom builds with website maintenance. The difference is that the work is planned and proportionate, rather than a daily race against attackers.

An extra layer of server protection: pcarmour Server Shield

Whether a site runs WordPress, Magento or custom code, the server underneath it needs protecting too, and PHP2Shell made that impossible to ignore. Attackers now use AI to test new weaknesses against websites and servers within hours of publication, to guess passwords slowly from many addresses so that simple limits never trigger, and to hide in log noise that nobody has time to read. Rules and manual checks alone can't keep pace.

That is why we built pcarmour Server Shield, our own server protection product, designed to fight this new wave of AI-driven attacks. It runs on Linux and Windows servers, with or without Plesk or cPanel, and adds a layer of defence beneath every website on the server:

• Blocking shared across servers. An attacker caught on one server is banned on all of them, alongside public blocklists, and slow password guessing spread over days is caught too.
• Daily vulnerability checks. Server packages, Windows, and WordPress plugins, themes and core are checked every day against known vulnerabilities, and vulnerable plugins can be updated safely with automatic roll-back if a site breaks.
• Intrusion, malware and ransomware detection, plus checks for exposed files such as .env and .git, rogue files, new users and SSH keys.
• Backups you control. Every website, database and folder is backed up to your own storage and test-restored every week, so a compromised site can be restored quickly.
• AI that explains. A plain-English health report for each server puts the worst risks first, with exactly what to do. The AI advises; it never changes a server on its own.

Server Shield is not a substitute for patching or for moving off a high-risk platform. It narrows the gap between a new flaw appearing and an attacker using it, and it gives you a clean way back if the worst happens.

What to do now while you plan a migration

A migration needs proper planning. Until it is done, these steps reduce the risk on an existing WordPress or Magento site:

1. List every plugin, extension and theme, and remove anything you don't use.
2. Replace anything that hasn't been updated in the past year, or whose paid licence has lapsed.
3. Turn on automatic updates for the core and components wherever your platform supports them.
4. Ask your host which PHP version the site runs on. It should be on the latest release for its branch, which includes the October 2026 PHP2Shell fixes and PHP's follow-up updates; older, unsupported versions need upgrading.
5. Put a web application firewall in front of the site, so known attacks are blocked before a patch exists.
6. Add server-level protection such as pcarmour Server Shield, so attackers are blocked across all your servers and the server's own software is checked every day.
7. Keep tested, off-site backups so a compromised site can be restored quickly.

If you think a site may already have been compromised, contact our cyber security helpline straight away, or read more about our wider cyber security services.