Outdated Plugins and Software: How Known Holes Get Websites Hacked

Updated 6 min read

Outdated software is dangerous because its holes are public. When a plugin, theme or library gets a security fix, the problem is usually published too, and bots start looking for sites still running the old version. Updating is how you close a door that everyone already knows about.

In short

  • In 2025, the most heavily targeted WordPress holes were first attacked a median of five hours after they were published, Patchstack found.
  • 91% of new WordPress security holes in 2025 were in plugins and 9% in themes. WordPress itself had six.
  • Turn on auto-updates, delete what you don’t use, and replace plugins nobody maintains any more.

Why an old version is an open door

A published security hole tells the whole world which product is affected, which versions, and roughly what goes wrong. Attackers turn that into software that checks sites for the vulnerable version, and they don’t wait long.

Patchstack, a company that tracks WordPress security, counted 11,334 new vulnerabilities in WordPress plugins, themes and core in 2025, 42% more than in 2024. For 46% of them, the developer had no fix ready by the time the hole was made public. For the most heavily targeted ones, the weighted median time from publication to the first attack was five hours.

It isn’t only a WordPress problem. Anything your site runs on can go out of date: the server’s software, the database, a JavaScript library your theme loads, or the framework your developer built on.

Real cases

  • Equifax, 2017. In March 2017, the US Computer Emergency Readiness Team warned about a hole in Apache Struts, software that Equifax’s online dispute portal ran on. According to the US Government Accountability Office, Equifax passed the warning around on an out-of-date mailing list, so it didn’t reach the people who should have installed the fix, and a scan a week later didn’t spot the problem on the portal. Attackers got in through that portal and accessed the personal information of at least 145.5 million people. Equifax agreed to pay at least $575 million, and potentially up to $700 million, in a 2019 settlement with the FTC, the Consumer Financial Protection Bureau and US states.
  • TalkTalk, 2015. When the ICO investigated the SQL injection attack on TalkTalk, it also found the company’s database software was out of date, with a fix for a known bug available for more than three and a half years before the attack.
  • Log4j, 2021. In December 2021, a hole was found in Log4j, a logging library used in a great deal of Java software. The US Cyber Safety Review Board called it one of the most serious software vulnerabilities in history, and found that many companies couldn’t quickly work out where in their systems the vulnerable code was. It expects unpatched versions to stay in use for years to come, perhaps a decade or longer.
  • WordPress plugins, 2024. Attacks carried on long after fixes were out. In May 2024, WPScan reported attacks on sites still running versions of LiteSpeed Cache older than 5.7.0.1, which had been fixed the previous October. And it logged 5,576,488 attempts against a hole in WP Automatic within six weeks of the hole being published.

What “up to date” means for your site

  • WordPress, Joomla, Drupal and similar: the core software, every plugin and every theme, including the ones that are switched off.
  • Hosted builders such as Shopify, Wix and Squarespace: you don’t install platform updates yourself. The apps and add-ons you choose, and any custom code, are still yours to review.
  • Custom sites and apps: the framework and every package they use. Your developer’s tools can list outdated packages in seconds, so ask when that was last done.
  • Your own server, if you rent one rather than using a hosting plan: its operating system and software are your job, or your provider’s if it’s managed.

How to keep WordPress up to date

  1. See what’s waiting. Go to Dashboard → Updates. WordPress also shows a small bubble in the admin menu when something needs updating.
  2. Set up backups first. WordPress’s own guide suggests automatic backups before you turn on auto-updates, so you can roll back if an update breaks something.
  3. Turn on auto-updates for plugins. On the Plugins screen, click Enable auto-updates next to each plugin, or tick them all and choose it from the bulk actions menu.
  4. Turn on auto-updates for themes. Under Appearance → Themes, click a theme, then Enable auto-updates. WordPress runs auto-updates twice a day and emails you afterwards.
  5. Delete what you don’t use. A switched-off plugin or theme still leaves its files on your server.
  6. Replace plugins nobody looks after. On a plugin’s WordPress.org page, the warning that it “hasn’t been tested with the latest 3 major releases of WordPress” is a sign it may no longer be maintained. A closed plugin’s page says it’s no longer available for download, and one of the reasons WordPress.org closes plugins is a security issue.
  7. Check that auto-updates actually run. They depend on WordPress’s scheduled tasks. Tools → Site Health shows an error if those aren’t working.

A good rule: 14 days

If you want a deadline, the UK’s Cyber Essentials scheme sets one. Its requirements (version 3.3, April 2026) say software must be supported by its maker, removed once it no longer is, set to update automatically where possible, and updated within 14 days when a release fixes a critical or high-risk hole. Even if you’re not applying for the certificate, it’s a sensible standard to hold yourself to. For holes that are already under attack, five hours says sooner is better.

What Teyna checks

Teyna’s free check looks for plugins and software on your site that need updating, and tells you which update closes each hole. Paid plans check again every week, so a newly published hole in something you run shows up in your next report, and when you mark a problem fixed, Teyna checks again within 15 minutes to confirm it’s closed. On Pro, it can also read your code repositories for packages with published holes. For a server, type its IP address instead of a web address: Teyna checks which software answers from outside and whether it has known holes. It sees what your site shows from outside; it can’t see inside your server.

Is your website safe? Find out in a minute.

The free check reads only what anyone on the internet can already see: the padlock, email protection, open backups and signs of a hack. No sign-up and no card. We only ask for your email to send you the link to your report.

Scan my site for free

Questions

Is it safe to turn on auto-updates?

WordPress added auto-updates for plugins and themes in version 5.5 so that fixes arrive without waiting for you. The one precaution its guide suggests is automatic backups first, so you can roll back if an update clashes with something.

What happens if I don’t update?

Usually nothing you’d notice, until a hole in something you run is published and bots find your site. Then it can be used the way the attacks above were: to steal data, add the attacker’s own admin accounts or plant scripts on your pages.

How do I know if a plugin is abandoned?

Look at its page on WordPress.org: when it was last updated, and whether it shows the warning that it hasn’t been tested with the latest three major WordPress releases. If the plugin has been closed, the page says it’s no longer available for download. Replace it with a maintained alternative.

Do Shopify, Wix and Squarespace sites need updating?

There’s no platform update for you to install: the company that runs the platform does that. The apps, add-ons and custom code you add are still yours to review, and to remove when you stop using them.

What does “no fix available” mean?

It means the hole is public but the developer hasn’t released an update yet. Patchstack found that was the case for 46% of the WordPress vulnerabilities it handled in 2025. Until a fix arrives, the safest option is to delete the plugin or replace it.

sources