Why neglected WordPress plugins become a security risk.

WordPress on its own publishes pages and posts. Extra features, such as a contact form, a booking calendar or a shop, are usually added with plugins. Each plugin is a separate program, written by a separate person or company, that runs inside your website.

That arrangement is why WordPress is so flexible. It also means the safety of the site depends on a list of authors you have probably never looked at.

Who looks after a plugin

WordPress has a security team. Its job, in its own words, is to find and fix security issues in the WordPress core software. Plugins are handled differently. A weakness found in a plugin is reported to that plugin’s developer and to the WordPress plugins team. So each plugin depends on its own developer for fixes.

Some plugin developers are companies with staff, and some are individuals. Either can stop work on a plugin.

Four ways a plugin ends up neglected

• The fix exists and nobody installs it. The developer released an update, and it is still sitting in the dashboard waiting for someone to press the button.
• The developer has stopped. There are no more updates to install. The WordPress plugin directory shows a notice on a plugin’s page when it has not been tested with the latest three major releases of WordPress.
• The plugin has been closed. A closed plugin is no longer available to download from the directory. WordPress lists the possible reasons, and a security issue is one of them. It does not publish the details.
• It was switched off and left there. WordPress treats deactivating and deleting as two separate steps, and its hardening guide says a plugin you are not using should be deleted from the system.

The first is the easiest to fix and the last three are the easiest to miss, because there is no update waiting to prompt anyone.

What an attacker does with one

Nobody has to pick your business out. In an alert published in July 2026, the Australian Signals Directorate described attackers scanning websites in bulk for known weaknesses in content management systems and their plugins. It said many small and medium Australian businesses had been affected. The weaknesses were public, and patches for them were already available.

Once in, the attackers installed a web shell, which is a file that lets them control the web server from a distance. The alert lists what that access is used for:

• defacing or disrupting the website
• capturing passwords and other details that visitors type into it
• loading malware to target and scam the site’s own visitors
• using the web server as a way into the rest of the organisation’s network

This applies to small plugins as much as large ones. OWASP, the group behind the Top 10 list of web application risks, points out that a component typically runs with the same privileges as the application it is part of. A flaw in a plugin that adds one small button is a flaw in the whole site.

How to audit your plugins

1. Open the Plugins screen in the WordPress dashboard and list every plugin, active or not.
2. Next to each one, write what it does and whether the site still needs it. If nobody can say, treat it as unused.
3. Delete the unused ones. Take a backup first, and check the site afterwards.
4. Install any updates that are waiting.
5. Look up each remaining plugin in the WordPress plugin directory. Note any that show the out of date notice, or that have been closed.
6. Find a maintained replacement for each of those, or ask a developer whether the feature is still needed at all.
7. Decide who will repeat this, and put it in the calendar every quarter.

Since version 5.5, WordPress can update each plugin automatically, and it emails the site owner after every attempt. The Australian Signals Directorate suggests applying security patches automatically where a faulty one could be rolled back easily. In practice that means having a recent backup you know how to restore before you switch it on. See A backup you have never restored is a guess.

What to look for before adding a plugin

• Where it comes from. WordPress’s advice is to use its own plugin directory or well-known companies, and to avoid untrusted sources.
• Whether it is maintained. Check when it was last updated and which version of WordPress it has been tested with.
• Whether you need it. Every plugin is one more thing to keep updated. OWASP’s first recommendation for this risk is to remove unused components and features.
• Who will own it. Somebody in the business, or your website provider, should know it was added and why.

Where to go next

The free website health check and security headers check show what your site looks like from the outside. They do not replace the audit above, which needs a login. If you would like someone else to do the audit and the updates, maintenance is part of Websites, and a wider review is part of Vulnerability Assessment.