A sobering new investigation by the cybersecurity research firm Censys has cast a harsh spotlight on the state of web maintenance, revealing that a significant portion of the WordPress ecosystem remains dangerously outdated. The study, which analyzed a sample of over 316,500 WordPress installations, found that only 14% were running the most recent version of the core software at the time of the audit. While the raw figure suggests that 86% of sites are lagging, the reality is more nuanced—and perhaps more alarming.
The findings underscore a critical disconnect between the pace of digital threat evolution and the maintenance habits of web administrators. As attackers increasingly rely on automated, low-effort scanning tools, the "security through obscurity" approach—or simply ignoring updates—has become a liability that threatens not just individual sites, but the integrity of the broader internet.
The Scope of the Problem: Beyond the 14%
Censys identified over 59 million public-facing entities linked to WordPress, distributed across roughly one million unique IP addresses. However, technical limitations meant the researchers could only verify both the WordPress and PHP versions for approximately 316,500 of these sites.
While it would be statistically inaccurate to claim that exactly 86% of every WordPress site on the planet is vulnerable, the data provides a clear indicator of the habits within the community. The study reveals a profound delay in updates among sites whose configurations are visible to public scanners. Crucially, researchers noted that attempting to hide version numbers does not provide actual security; it merely adds a minor hurdle for attackers, who continue to use automated scripts to probe for known vulnerabilities regardless of whether a version is explicitly displayed.
Chronology: The Lifecycle of a Vulnerability
The snapshot provided by Censys is not merely a static observation; it is a reminder of how quickly security windows close. When the data was collected, roughly 44,000 sites in the sample were running WordPress 7.0, which was the latest version at the time. This accounted for the 14% mentioned in the report.
However, the digital landscape moves rapidly. Since the publication of the report, the WordPress project has released critical revisions. On July 17, 2026, WordPress 7.0.2 was pushed to the public. This was not a minor feature update; it was a security-mandated patch. The release addressed two high-severity vulnerabilities: a SQL injection flaw and a path confusion issue within the REST API routes that could have allowed for remote code execution.
Due to the severity of these flaws, WordPress.org took the unprecedented step of forcing updates on all sites compatible with its automatic update system. Furthermore, security patches were backported to versions 6.9.5 and 6.8.6. This sequence of events highlights the core issue: the Censys report reflects a "photograph" taken on July 1, 2026. By July 17, the security posture of the entire internet changed, yet millions of administrators remained on older, vulnerable versions, unaware or unable to pivot.
Supporting Data: The Multi-Layered Risk
The security of a website is not monolithic. Even if a site administrator updates the WordPress core, they may remain exposed through other layers of the tech stack. The Censys data breaks down this systemic risk:
- WordPress Core: Only 14% were running the most recent version, leaving the majority exposed to known, patched exploits.
- PHP Environment: Over 70% of the sample utilized outdated versions of PHP. Most notably, PHP 7.4—which reached its end-of-life in November 2022—was still present in 20% of cases.
- Plugin Ecosystem: The study tracked the "Yoast SEO" plugin as a proxy for the broader ecosystem. Less than 22% of identifiable installations were using the latest version.
- Server Configuration: Researchers found widespread exposure of sensitive services like XML-RPC and SSH, which are frequent targets for brute-force attacks.
The PHP situation is particularly concerning. While upgrading PHP can be technically challenging due to potential compatibility issues with older plugins or themes, running an end-of-life version means the server is inherently unprotected against new, publicly disclosed vulnerabilities. This is a ticking time bomb for many businesses that rely on legacy code.
Implications: Automation and the "MR.GREEN" Phenomenon
The primary reason for this widespread neglect is a misunderstanding of how modern cyberattacks occur. Attackers no longer focus on individual targets with sophisticated, bespoke hacks. Instead, they operate at scale. They deploy botnets to scan millions of domains, looking for specific markers of neglect: an outdated plugin, an exposed xmlrpc.php file, or a weak administrative password.
A prime example is the "MR.GREEN" defacement campaign. In June 2026, over 900 websites were found displaying the message "Hacked By MR.GREEN." While the specific entry point for every site was not definitively identified, the pattern was clear: many of the victims were running obsolete software, had the xmlrpc.php file exposed, or used insecure SSH configurations.
GreyNoise sensors further confirmed this reality, recording 70 different IP addresses actively searching for xmlrpc.php endpoints in the 90 days leading up to the report. The message to administrators is clear: if you are not updating, you are not invisible; you are merely waiting to be indexed by an automated attack tool.
Best Practices: How to Maintain Without Breaking
The fear of an update "breaking" a site is the most common justification for delaying maintenance. However, this fear is a symptom of poor site architecture rather than a reason to avoid security. To maintain a secure site without sacrificing stability, administrators should adopt a professional lifecycle management process:
- The Staging Environment: Never update in production. Create an exact replica of the site—including the server environment, PHP version, and database—to test updates before applying them to the live site.
- Backup Strategy: Perform a full backup of the database and files before any change. Ensure these backups are stored off-site and verified for restoration.
- The Update Hierarchy: Always update the WordPress core first, followed by plugins, and finally the theme. This order minimizes conflicts.
- Automate Sensibly: Enable automatic security updates for the WordPress core. These are rarely breaking and are essential for mitigating immediate threats.
A website that cannot be updated without failing is a website that requires a structural overhaul. Relying on legacy code or abandoned themes is not a strategy; it is a liability that puts user data, SEO rankings, and brand reputation at risk.
Conclusion: The Responsibility of the Admin
The data from Censys serves as a wake-up call. While the 14% figure might be subject to sampling bias, the underlying message is undeniable: the internet is populated by millions of "low-hanging fruit."
For the average site owner, the path forward is clear. Security is not a one-time setup; it is a continuous, iterative process. By moving away from legacy PHP versions, auditing plugins for abandonment, and instituting a staging workflow, administrators can transition from being a target to being a resilient participant in the modern web. The tools for security exist; the only missing component is the commitment to use them.
FAQ: Understanding the WordPress Security Landscape
Is it accurate to say 86% of all WordPress sites are outdated?
No. This percentage represents a specific sample of 316,500 sites that were publicly broadcasting their version information. It does not reflect the entirety of the 59 million WordPress entities detected by Censys, though it does indicate a widespread trend of poor update hygiene.
What is the current recommended version of WordPress?
As of the latest major update, WordPress 7.0.2 (released July 17, 2026) is the secure version that all administrators should be running to protect against critical SQL injection and REST API vulnerabilities.
Why is an old PHP version dangerous if WordPress is updated?
PHP is the engine that powers WordPress. If the engine is outdated, it may have unpatched security holes that exist outside of WordPress’s control. Furthermore, many modern plugins and themes are built to interact with newer PHP functions; running old versions creates compatibility issues and leaves the site vulnerable to exploits that target the underlying server environment.
Should I enable all automatic updates?
Security updates for the WordPress core should be enabled by default. For larger feature updates and third-party plugins, it is recommended to test them in a staging environment first to ensure no conflicts occur. However, never let the fear of a minor bug prevent the installation of a critical security patch.
