Most WordPress vulnerabilities live in plugins and themes you can uninstall. A flaw in core itself — reachable on a default install with no add-ons — is a different, rarer animal. The data on why wp2shell stands out.
Here's a number that reframes how you should think about WordPress security. In 2024, Patchstack catalogued 4,166 new WordPress vulnerabilities. Of those, 96% were in plugins, 4% in themes, and just 7 were in WordPress core — none, in their assessment, dangerous enough to pose real risk. In 2025 the shape held: 91% plugins, 9% themes, and only 6 low-priority core issues. Core is the boring part of the WordPress attack surface. It almost never breaks in a way that matters. That is exactly why wp2shell is worth understanding — it's the exception, and the exceptions are the ones that hurt.
I think most site owners have their WordPress threat model backwards. They worry about core updates breaking their site and click 'update' on plugins without a thought — when the data says the danger runs the other way. Let me lay out why, and why this particular core flaw earns the alarm.
Where WordPress vulnerabilities actually live (Patchstack, 2024 data — 4,166 total)
Plugins96%
Themes4%
Core7 total (~0.2%)
Why plugins dominate the vulnerability count
It's not that plugin developers are careless. It's structural. WordPress core is one codebase, reviewed by thousands of contributors, with a formal security team, a standardized process, and decades of scar tissue. The plugin ecosystem is 60,000-plus separate codebases written by independent developers of wildly varying experience, often as side projects, frequently abandoned, rarely audited to the same standard. When you install ten plugins, you've taken on ten separate vendors' security practices — and the Patchstack numbers are what that looks like in aggregate.
This is why 'reduce your plugin count' is the single most effective piece of WordPress security advice nobody wants to hear. Every plugin is attack surface you've voluntarily bolted on. The miniOrange OAuth SSO flaw disclosed the same week as wp2shell is a textbook example: a 9.8 authentication bypass in a single plugin, no core involvement, affecting only the sites that chose to install it.
Plugins are 60,000+ independent codebases. Core is one, watched by thousands. The risk math follows from that. · Pexels
So why is a core flaw scarier?
Because you can't uninstall core. A plugin vulnerability affects only sites that installed that plugin, and the fix can be as blunt as deactivating it — the miniOrange flaw is contained to miniOrange users, who can switch it off. A core vulnerability affects every WordPress site on the vulnerable version, on a default install, with nothing extra required. There's no component to remove. The only fix is patching core itself, which is why wp2shell warranted a forced auto-update — the blast radius is, potentially, the entire platform.
And wp2shell is genuinely dangerous, not just rare. Rapid7's analysis describes an unauthenticated pre-auth RCE built by chaining a REST API batch-route confusion (CVE-2026-63030) with a SQL injection in core's WP_Query (CVE-2026-60137). No login, no plugin dependency, no user interaction — an anonymous HTTP request to a default install. That's the worst-case profile, and it landed in the one part of WordPress that's normally quiet. When the boring part of your stack has a critical RCE, that's precisely when to move fast.
Core flaw vs plugin flaw — why they're different problems
Who's affected
Core vulnerability (wp2shell)
Every site on the version
Plugin vulnerability (miniOrange)
Only sites with the plugin
Prerequisite
Core vulnerability (wp2shell)
Default install, no add-ons
Plugin vulnerability (miniOrange)
That specific plugin installed
How to fix
Core vulnerability (wp2shell)
Patch core (can't remove)
Plugin vulnerability (miniOrange)
Update or deactivate plugin
How common
Core vulnerability (wp2shell)
Rare (a few/year, usually minor)
Plugin vulnerability (miniOrange)
Thousands/year
This case
Core vulnerability (wp2shell)
Critical pre-auth RCE
Plugin vulnerability (miniOrange)
9.8 auth bypass
Core vulnerability (wp2shell)
Plugin vulnerability (miniOrange)
Who's affected
Every site on the version
Only sites with the plugin
Prerequisite
Default install, no add-ons
That specific plugin installed
How to fix
Patch core (can't remove)
Update or deactivate plugin
How common
Rare (a few/year, usually minor)
Thousands/year
This case
Critical pre-auth RCE
9.8 auth bypass
What to actually take from this
Quick answers
If core is so safe, why did wp2shell happen?
Rare isn't never. Core has a strong security record — a handful of low-severity issues in a typical year — but it's still software written by humans, and REST API and query-building code is genuinely complex. wp2shell is the reminder that 'rarely vulnerable' isn't 'never vulnerable,' which is exactly why a core security release should be treated as the exceptional event it is.
Does this mean I should worry less about plugins?
The opposite — plugins are where almost all the actual vulnerabilities are, so keeping them updated and minimal is the higher-frequency win. The point isn't 'ignore plugins,' it's 'also take core security releases seriously,' because people tend to under-react to those precisely because core is usually quiet.
How many plugins is too many?
There's no magic number, but every plugin is a separate codebase you're trusting. A good habit: for each installed plugin, ask whether it still earns its place. Deactivated-but-installed plugins still count — their code can be vulnerable even when 'off.' Delete what you don't use rather than just disabling it.
Are managed WordPress hosts safer from core flaws?
Often faster to patch, yes — many apply core security fixes or virtual patches server-side within hours, sometimes before the forced update reaches individual sites. It doesn't make you immune, but it shifts some of the response burden to the host. We break down who was actually exposed in a separate piece on managed versus self-hosted WordPress.
The full data is in Patchstack's 2025 and 2026 security reports. The takeaway I'd hold onto: WordPress security isn't one problem, it's two — a steady drizzle of plugin flaws you manage with hygiene, and the occasional core thunderclap like wp2shell that demands you move now. Knowing which one you're looking at is half the battle, and our security audit guide covers both.
