Will AI Hacking Kill WordPress? An Honest Answer

As of 23 October 2026, WordPress is still the most widely used content management system on the web, PHP2Shell has been fixed in the PHP engine that runs underneath it, and no WordPress update was needed or planned for that flaw. The honest answer to "will AI hacking kill WordPress?" is no, not on the evidence available today. AI is making flaws faster to find and faster to exploit across all software, but nothing in the data shows WordPress collapsing under it.

What AI does change is the cost of being slow. Most WordPress vulnerabilities come from plugins and themes, not WordPress itself, and the time between a fix and an attack keeps shrinking. The sites at risk are the ones running old PHP, many unmaintained plugins and no one assigned to apply updates. Those problems have practical fixes, and for some sites, moving to a static or headless setup is one of them.

This guide looks at WordPress's size and security record with sources and dates, where its flaws actually come from, what AI changes, the case that the AI threat is overhyped, the "most secure language" question, and who should and should not consider leaving.

The Short Answer

"Kill" would mean WordPress becoming unsafe to run no matter what you do. That isn't what the data shows. WordPress core had six reported vulnerabilities in 2025, all low priority, according to Patchstack. The project has a dedicated security team, backports fixes to older versions, and coordinates with major hosts. When PHP2Shell landed, managed WordPress hosts reported patching PHP across their platforms within about a day.

What AI threatens is a particular way of running WordPress: a site on an old server, with dozens of plugins installed years ago, updated whenever someone remembers. That setup was already risky. Faster exploitation makes it riskier. The fix is to change how the site is run, which may or may not mean changing platforms.

How Big WordPress Is, and Why the Numbers Differ

You will see different WordPress market share figures quoted. They are not contradictory; they measure different things and come from different sources.

W3Techs also reports that 66.9% of WordPress sites it surveys run version 7, with 26.3% on version 6 and the rest on older versions. For comparison, W3Techs puts Shopify at 5.3% of all websites, Wix at 4.2%, Joomla at 1.1% and Drupal at 0.6%.

Size cuts both ways. A platform this common is an obvious target for automated scanning. It also means a large security industry, many experienced developers, and hosts that build their whole business around keeping it patched.

Where WordPress Vulnerabilities Actually Come From

The Patchstack State of WordPress Security in 2026 whitepaper, which covers 2025 data, gives the clearest breakdown available.

Two points stand out. First, the risk lives in the add-ons, which is why our WordPress security guide is subtitled "It Is Almost Never WordPress." Second, nearly half of plugin and theme flaws had no fix available when they were disclosed, so "just keep everything updated" is not a complete plan on its own. Fewer plugins, chosen carefully, is part of it. Our guide to plugin and package supply chain risk covers how to vet them.

Rising counts also partly reflect better reporting. VulnCheck notes that the jump in exploited CVEs from 2024 "appears to closely align with the rapid growth in WordPress plugin-related KEVs after Patchstack, Wordfence, and WPScan began scaling CVE assignment for WordPress plugins." More flaws are being numbered and tracked, not only more being created.

PHP2Shell Was a PHP Problem, Not a WordPress Problem

PHP2Shell is the name for two critical flaws in the PHP engine, CVE-2026-109618 and CVE-2026-109619, fixed on 21 October 2026. WordPress.org's 21 October post was direct: "These vulnerabilities are not specific to WordPress and affect any server that hosts a PHP application. No WordPress update is required or planned for these issues."

Wiz did demonstrate an attack against the official WordPress container image, alongside Drupal and Joomla, but it described them as "representative targets - exploitation does not require one of these CMSs." Calif, the first team to report the flaws, confirmed exploitation against a long list of PHP software including Drupal, Joomla, MediaWiki, Magento, Nextcloud, Laravel and Symfony. Leaving WordPress for another PHP application would not have helped. Our plain-English guide to what PHP2Shell is covers who was and wasn't affected.

What did help was the hosting setup. Fully hosted builders had no customer-run PHP to patch, and managed hosts patched PHP for their customers. Our PHP2Shell guide for WordPress covers the specific steps for WordPress site owners.

What AI Changes for WordPress

AI affects both sides of WordPress security. On the attack side, Patchstack writes that "attackers are being equipped with AI that is increasingly capable of autonomously finding and exploiting security vulnerabilities." It also found that for high-impact WordPress flaws in 2025, "approximately half... get exploited within 24 hours," with a weighted median time to first exploit of 5 hours. Wiz, writing about PHP2Shell, says that "as AI reduces the effort needed to develop and adapt complex exploits, vulnerabilities that once seemed impractical to exploit become viable targets."

On the defense side, the same tools are available to WordPress's maintainers, hosts and security vendors. WordPress.org says its Security Team includes "more than 50 trusted experts" and "works directly with significant web hosting operators and security ecosystem providers... including coordinating release rollouts and developing web application firewall (WAF) mitigations." It also says the team "backports fixes to older versions as a courtesy, to ensure older sites receive critical security fixes via auto-updates."

AI also creates noise. Patchstack saw "a significant increase of AI generated 'slop' vulnerability reports in 2025," and the PHP Foundation reported more than 100 invalid, duplicate or unreproducible reports since July. More reports do not always mean more real flaws. For the wider picture on AI and patch speed, see our guide to what AI-found flaws mean for small business sites.

The Counterpoint: Is the AI Threat Overhyped?

A fair answer has to include the case that the AI threat is being oversold. VulnCheck, which tracks real-world exploitation, wrote in its July 2026 report: "The data so far, including Anthropic's own stalled disclosure ledger, suggests that AI-assisted vulnerability discovery and frontier capabilities have been overhyped relative to the evidence available today."

Its supporting figures:

• Of 1,061 vulnerabilities attributed to AI-assisted discovery, 14, or 1.3%, had been confirmed as exploited, "roughly matching the overall exploitation rate."
• Anthropic reported more than 23,000 findings through Project Glasswing, "but only 126 have resulted in published CVEs, and just one has been confirmed as exploited in the wild."
• Giving defenders frontier models "is more likely to give defenders an advantage in strengthening software than to give attackers an advantage."

VulnCheck still adds: "That doesn't mean the risk is imaginary. It means the impact has been real but modest."

The agency view is more urgent. The Five Eyes joint statement of June 2026, signed by the heads of agencies including CISA and the UK NCSC, says AI is "shrinking the window between vulnerability discovery and exploitation ever more quickly" and that, for frontier AI capabilities, "The timeline is not years, it is months." Security vendors quoted on Anthropic's Project Glasswing page go further.

Both views lead to the same practical advice for a WordPress site: patch quickly, carry less software, and don't run unsupported versions. Neither says WordPress is finished.

Is There a "Most Secure" Language?

PHP2Shell is a memory-safety bug: PHP's advisories classify it as "use after free." The PHP engine itself is written mainly in C, according to its GitHub repository, and CISA's guidance names C and C++ as "examples of memory unsafe programming languages." That has prompted questions about whether websites should move to a "safer" language.

The main government guidance on this is CISA's The Case for Memory Safe Roadmaps (December 2023), co-authored with the NSA, FBI and international partners. It says "memory safety vulnerabilities are the most prevalent type of disclosed software vulnerability" and lists C#, Go, Java, Python, Rust and Swift as memory safe languages. PHP is not on that list. The same document also says: "No one MSL is right for all programming needs." CISA and the NSA followed up in June 2025 with a joint guide on obstacles to adopting memory safe languages.

The same roadmap adds a caveat that matters here: memory safe languages, "whether they use a garbage collection model or not, will almost certainly need to rely on libraries written in languages such as C and C++." A Python or Java website still runs on interpreters, runtimes and libraries that contain C or C++ code. The roadmap's own guidance is aimed at software manufacturers planning long-term transitions, not at site owners choosing a CMS.

So the useful takeaway is narrower than "pick language X." For a website, these matter more than the language name:

• How much code runs on the public server and is reachable from the internet.
• Whether the runtime and libraries are on supported versions.
• How fast fixes reach your server, and who applies them.

What Actually Reduces Risk on a WordPress Site

None of these steps is new, which is the point. AI raises the cost of skipping them.

Our guide to WordPress PHP versions covers checking and upgrading PHP safely.

Who Should Consider Leaving WordPress, and Who Shouldn't

Leaving WordPress is a business decision, not a security reflex. It changes who is responsible for what rather than removing responsibility. Our guide to website security by platform sets out what each option covers and what it leaves to you.

A static or headless setup may make sense if

• Your site is mostly brochure content that changes a few times a month or less.
• Nobody is assigned to maintain WordPress, plugins and PHP, and that won't change.
• You depend on many plugins you can't vet or replace.
• You are a higher-profile target, such as a public agency or a regulated business, and want the smallest possible public attack surface.

In a headless setup, editors can keep a familiar content system while visitors are served pre-built pages or a separate front end, so the content system does not have to face the public internet directly. That moves risk rather than eliminating it: the build pipeline, hosting and packages become the new things to maintain. Our headless CMS development team can scope whether it fits.

Staying on WordPress usually makes sense if

• Your team edits content daily and relies on the WordPress editor and workflow.
• Your business runs on WordPress-specific features or plugins that would be costly to rebuild.
• You are on managed hosting, keep plugins lean, and someone applies updates promptly.

A well-run WordPress site on a supported, patched PHP version is a reasonable choice in 2026. A neglected site on any platform is not.

Conclusion

AI is not going to kill WordPress, but it is making neglect more expensive. The data shows WordPress core with few serious flaws, most risk in plugins and themes, and PHP2Shell sitting in the PHP engine beneath every PHP application. The fair reading of the AI evidence is that discovery and exploitation are getting faster while confirmed real-world damage from AI-found flaws is still modest. Either way, the steps are the same: supported PHP, managed hosting or maintenance, fewer plugins, fast updates, and a static or headless front end where it truly fits. If you want help deciding which of those your site needs, our website security services team can review your setup. Every PHP2Shell guide is in our PHP2Shell Resource Center.

Frequently Asked Questions