August 9, 2026 · Amaar Malik
Your biggest security risk is probably software you didn't write
The vulnerability data is lopsided: most breaches start in third-party add-ons, not the platforms themselves. Here's what that means for a small business.
Most small businesses think about security in terms of the big platforms they depend on: the email provider, the cloud host, the practice management system. Those companies employ security teams. They are, generally, not where things go wrong.
The risk sits in the layer above: the add-ons, plugins, integrations, and connected apps that someone installed to solve a problem eighteen months ago.
The numbers are lopsided
In 2025, 11,334 vulnerabilities were disclosed across the WordPress ecosystem. Of those, 91% were in plugins. Six were in the core platform itself.
The pattern holds in what actually gets exploited. Roughly 95% of WordPress compromises begin with a vulnerable or compromised third-party plugin, and around 52.8% of live sites are running at least one plugin with a known, already-patched vulnerability.
WordPress is the best-measured example because of its scale, but the shape of the problem is not specific to it. Anywhere you can extend a platform with third-party code, the extensions are the soft edge.
Why it persists
Three ordinary reasons, none of them negligence:
- Nobody owns the list. The person who installed the integration has often moved on, and it was never anyone's job to review it since.
- Patching is somebody else's decision. More than half of plugin developers who received a vulnerability report had not shipped a fix before it was publicly disclosed. You inherit their timeline.
- The window is short. Exploitation of newly disclosed vulnerabilities frequently begins within hours, not weeks. "We'll get to it next quarter" is not a plan.
What to actually do
You do not need a security team to close most of this gap. You need an inventory and a habit.
- Write down every third-party tool with access to your systems or data: integrations, browser extensions, connected apps, contractor accounts.
- Remove what nobody uses. The fastest security win available to most businesses is deleting things.
- Check what remains against known vulnerabilities, and decide who is responsible for updates.
- Re-run it periodically. Once is a snapshot; the value is in the repeat.
If that sounds like work you won't get to, that's precisely what a vendor and third-party review is for.
Sources: Patchstack State of WordPress Security 2026; aggregated WordPress vulnerability disclosure data for 2025.