
GuardingWP's inaugural State of WordPress Security 2026 report scanned 424 confirmed WordPress installs across 40-plus verticals. The headline finding is that more than half ship at least one plugin with a known unpatched CVE. Patchstack founder Oliver Sild said WordPress 7.0 will trigger an "absolute rush by hackers to steal API keys." This article reads both as evidence that the plugin economy is the structural problem and NIS2 plus DORA already encode the fix.

