11,334 new vulnerabilities in one year. Market share falling faster in six months than in all of 2025. Here is what that means if your business runs on it.
WordPress produced 11,334 new security vulnerabilities last year. It runs a smaller share of the web every month. It costs a small business real money every year to stand still.
I am not against WordPress on principle. I have moved several businesses off it, and I have kept clients on it when moving made no sense. But the arguments for defaulting to it in 2026 are weaker than most owners realise, so here is the current position with the numbers attached.
The security problem is structural, not occasional
Patchstack recorded 11,334 new vulnerabilities across the WordPress ecosystem in 2025, a 42% rise on 2024. Of those, 91% were in plugins and 9% in themes.
Read that split again. The vulnerabilities are almost never in WordPress itself. They are in the plugins you install to make WordPress do what you needed.
A typical small business site runs 15 to 30 plugins. Each one is code written by a different person, on a different schedule, to different standards. You have given every one of them full access to your website and its database. Each one is a supplier you never checked.
That is the structural part. You cannot patch your way out of it. The number rises every year because the model itself creates the exposure: 7,966 vulnerabilities in 2024, 11,334 in 2025.
There is a second-order effect I see constantly. Attackers scan for WordPress files on every site, whether the site runs WordPress or not. When we moved the Minds of Madness podcast off WordPress, Google's first report after launch flagged twelve broken links. Exactly one was ours. Most of the rest were bots still hunting for WordPress files that no longer existed.
The cost is not the licence. It is the upkeep.
WordPress is free. The site is not.
For a small business site, the yearly running cost lands between CAD 300 and CAD 2,000 before anyone touches a page:
- Managed hosting that can survive a busy day
- Premium plugin licences, commonly CAD 100 to CAD 500 a year for forms, caching, and SEO tools
- Security monitoring and backups
- A maintenance plan, or your own time, to apply updates
Then add the part owners underestimate. Updates break things. A plugin update changes a layout, a theme update breaks a form, and somebody has to notice and fix it. That is either a monthly retainer or an emergency call, and both are billed.
The Central Kootenay Invasive Species Society described it exactly right before we rebuilt their site. They were paying for software upkeep whether or not anyone published anything that month.
The platform itself is unsettled
Since September 2024, Automattic and WP Engine have been in litigation, and the dispute is still unresolved in 2026. Automattic reduced its paid contributions to the open-source project during the fight, and the core release schedule slowed with it.
You do not need an opinion on who is right. You need to know two things. A US federal court is deciding the governance of the software your business runs on. The pace of releases now waits on that outcome.
The market has started voting
WordPress powered around 43.5% of all websites at its peak in early 2025. By mid-2026 it was near 41.2%.
The rate matters more than the number. WordPress lost more market share in the first half of 2026 than in all of 2025. That is the first sustained decline in over a decade.
It is still the largest content system on the web by a wide margin, and it will be for years. It is no longer the automatic answer.
When WordPress is still the right call
I will say this plainly, because most posts on this subject will not.
Stay on WordPress if your site works, your team knows it, and you have someone maintaining it properly. A working site with a small maintenance bill is not a problem that needs solving.
Stay if you depend on a specific plugin ecosystem that has no equivalent elsewhere, such as some membership, learning, or specialised booking setups.
When it is worth leaving
Leave when the maintenance bill exceeds the value you get from it. Leave when you have been hacked, or when your host quarantines your site. Leave when a page takes six seconds to load on a phone and nobody can fix it. Leave when a redesign quote is higher than a rebuild.
And leave when the plugins outnumber the pages. That is a sign the platform is working against what you actually need.
What replaces it
A custom-built site with no plugin surface to attack, a database you own, and an editor built for the way your staff actually work. Hosting for a site like that usually costs a fraction of managed WordPress hosting, and there is no update queue to keep on top of.
That is what I build. Every site is coded for the business it belongs to, and every one of them comes with a back end the owner can run without calling me.
If you want an honest read on whether your WordPress site is worth keeping, send me the address. I will tell you either way. jon@delcaromedia.com
Sources: Patchstack, State of WordPress Security 2026. W3Techs CMS usage statistics, 2025 to 2026. Court filings in Automattic v. WP Engine, ongoing as of mid-2026.