# Vulnerable WordPress plugins: how to check yours for security flaws

> How to check your WordPress plugins and themes for published vulnerabilities, why an updated site still gets hacked, and what to do with a plugin with no fix.

URL: https://webintacta.com/en/guides/vulnerable-wordpress-plugins
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-24

**In short:** Most of the hacked WordPress sites I work on got in through a plugin or theme with a published flaw, not through WordPress core. To check yours, list every plugin and theme with its exact version, including inactive ones, and look them up in a vulnerability database such as WPScan, Wordfence Intelligence or Patchstack. Being up to date in the dashboard is not enough: a plugin closed on WordPress.org, abandoned, premium with an expired license or downloaded from a nulled site gets no patches, and the dashboard will not warn you.


By Jose Soriano (WebIntacta) · published 2026-10-24

"But I keep everything updated." That is what I hear most when a hacked WordPress site lands on my desk, and it is usually only half true: the dashboard said nothing was pending, but there was a plugin that no longer gets updates, a premium one with an expired license, or an inactive one nobody deleted. This guide explains how to actually check the plugins and themes on your site, without relying on what the updates screen says.

## Why an "updated" site still gets hacked

The WordPress updates screen only knows about things that have a new version available. There are five cases where a vulnerable plugin never shows up there:

- **Plugins closed on WordPress.org.** When the directory closes a plugin over an unfixed security issue, it stops offering new versions. Your dashboard shows nothing pending because there is nothing to install.
- **Abandoned plugins.** The author stopped maintaining it. It still works, but any flaw found from now on will never be fixed.
- **Premium plugins with an expired license.** Elementor Pro, WPML, ACF Pro or WooCommerce extensions update from their author's servers, and only with an active license. Without one, the plugin stays on its version, flaws included.
- **Nulled copies.** A premium plugin downloaded for free from a third-party site never updates and, on top of that, often ships with a backdoor built in.
- **Plugins bundled with the theme.** Some commercial themes include a plugin (a slider, a page builder) that only updates when the theme author releases a new version.

And there is a sixth case that has nothing to do with updates: **an inactive plugin is still on the server**. Many flaws are exploited by calling the plugin's files directly, so deactivating it does not protect you. If you do not use it, delete it.

## Step 1: get the real list of plugins and themes

In the dashboard, **Plugins → Installed Plugins** shows every plugin with its version, active and inactive. Check **Appearance → Themes** too: themes you do not use count as well. And use your hosting file manager to look in `wp-content/mu-plugins/`, because plugins there ("must-use") do not appear in the normal list.

With SSH access and WP-CLI it is faster, and it also tells you each plugin's status on WordPress.org and when it was last updated there, which is the quickest way to spot closed and abandoned plugins:

```
wp plugin list --fields=name,status,version,update_version,wporg_status,wporg_last_updated
wp theme list --fields=name,status,version,update_version
wp plugin list --status=must-use
```

Write down each plugin's **technical name** (the name of its folder in `wp-content/plugins/`, which is what appears in the `name` column), not its marketing name: that is what you will search for in the vulnerability databases.

## Step 2: check the list against vulnerability databases

There are three public databases, free to search, that track flaws in WordPress plugins and themes with the affected version and the fixed one:

- **[WPScan](https://wpscan.com/)**, by Automattic. It is the one Jetpack Protect uses.
- **[Wordfence Intelligence](https://www.wordfence.com/threat-intel/vulnerabilities/)**, by Wordfence.
- **[Patchstack](https://patchstack.com/database/)**. It is the one Solid Security uses for its virtual patching.

Search for each plugin by its technical name and compare your version with the affected ones. If your version is in the range and a fixed version exists, update. If there is no fixed version, go to step 3. For WordPress core, the sensible thing is to always run the latest version; minor updates, which are the security ones, install automatically by default unless someone turned that off.

> Security plugins (Wordfence, Solid Security, Jetpack Protect) do this check automatically and alert you. It is the most useful thing they do for a small site. What they do not do is decide for you what to do with an unpatched plugin, or tell you whether someone has already used it to get in. The comparison is in [which security plugin to choose](https://webintacta.com/en/guides/best-wordpress-security-plugin).

## Step 3: if one of your plugins has an unfixed flaw

1. **If you do not need it, delete it.** Deactivating is not enough: delete it from the dashboard or remove its folder from `wp-content/plugins/`.
2. **If you need it, replace it** with a maintained plugin that does the same job. Make the switch with a [backup](https://webintacta.com/en/guides/wordpress-backup) first, and test it on a copy of the site if it is a store.
3. **While you decide,** a firewall with virtual patching (from a security plugin, or from your hosting provider or CDN) can stop known attacks against that flaw. It is a stopgap, not a fix.
4. **Check whether someone is already in.** If the flaw was serious and you were exposed for months, updating closes the door but does not kick out anyone already inside. The signs are in [how to tell if your WordPress site is hacked](https://webintacta.com/en/guides/how-to-tell-if-wordpress-is-hacked).

## Automatic updates: yes, with a backup

Since WordPress 5.5 you can turn on automatic updates plugin by plugin and theme by theme, from the **Automatic updates** column on the plugins screen. WordPress runs them twice a day and emails you the result. On a simple business website, turning them on for well-maintained plugins greatly cuts the time you spend exposed. On a store, it is better to update by hand, or with someone who tests checkout afterwards, because an update that breaks the cart costs sales.

In both cases the condition is the one the WordPress documentation sets: have a recent automatic backup and know how to restore it.

## How often to check

- **Every week:** pending updates and alerts from your security plugin. Flaws get published and start being exploited within days.
- **Every month:** the full list, with WP-CLI or from the dashboard, to catch closed, abandoned or unlicensed plugins.
- **Every time you install something:** check when it was last updated, how many active installs it has and whether the author answers in the support forum. Fewer plugins, fewer doors.

## If you would rather I check it

The [free scan](https://webintacta.com/en/free-website-security-scan) detects, from the outside, your WordPress version and the plugins that are publicly visible, and checks them against published flaws. For the full list, including inactive plugins and the ones not visible from outside, there is the [security report](https://webintacta.com/en/website-security-audit) with the [read-only connector](https://webintacta.com/en/read-only-connector) (€129, excluding VAT). And if you would rather not think about it, [WordPress maintenance](https://webintacta.com/en/wordpress-maintenance) (€35/month, no lock-in) includes weekly updates with a backup first and replacing abandoned plugins.

## Sources

- [WP-CLI: wp plugin list](https://developer.wordpress.org/cli/commands/plugin/list/) (the `update_version`, `wporg_status` and `wporg_last_updated` fields, and the `must-use` status).
- [WordPress: plugin and theme auto-updates](https://wordpress.org/documentation/article/plugins-themes-auto-updates/) (since WordPress 5.5, twice a day, with an email notice and the recommendation to keep automatic backups).
- [WordPress.org: detailed plugin guidelines](https://developer.wordpress.org/plugins/wordpress-org/detailed-plugin-guidelines/) (a plugin with security issues is closed until they are resolved).
- [WordPress: must-use plugins](https://developer.wordpress.org/advanced-administration/plugins/mu-plugins/) (always loaded and not shown in the normal list).
- Vulnerability databases: [WPScan](https://wpscan.com/), [Wordfence Intelligence](https://www.wordfence.com/threat-intel/vulnerabilities/) and [Patchstack](https://patchstack.com/database/).

## Frequently asked questions

### Why was my WordPress site hacked if everything was updated?

Because the updates screen only shows what has a new version. A plugin closed on WordPress.org, abandoned, premium with an expired license, or inactive but not deleted can have a published flaw without the dashboard saying anything. You may also have been attacked in the days between the flaw being published and your update.

### How do I know if a WordPress plugin has vulnerabilities?

Search for its technical name (the folder name in wp-content/plugins/) on WPScan, Wordfence Intelligence or Patchstack and compare your version with the affected ones. A security plugin does that check automatically.

### Is it enough to deactivate a vulnerable plugin?

No. Its files are still on the server and many attacks call them directly. You have to update it or delete it.

### What do I do if a plugin has been closed on WordPress.org?

If it was closed for security reasons and there is no fixed version, replace it with a maintained one or delete it. In the meantime, a firewall with virtual patching can stop known attacks, but it is not a solution.

### Is it safe to turn on automatic updates?

On a business website with well-maintained plugins, yes, as long as you have automatic backups and know how to restore them. On a store, it is better to update with someone who tests checkout afterwards.

## About the author

[Jose Soriano](https://webintacta.com/en/about): Full-stack developer specialized in PrestaShop, WordPress and WooCommerce, who has passed the official PrestaShop course and exam. He has been building online stores and modules since 2023 and is the founder of WebIntacta, the website security service through which he scans, cleans and maintains small-business websites and online stores himself, remotely from Ibi (Alicante, Spain). WebIntacta facts: https://webintacta.com/en/about#datos