Of 6,202 BY WordPress sites where we could read a component version, 4,583 (73.9%) run at least one plugin or theme in a version with a publicly known vulnerability. This measures patch hygiene — not that a site is exploitable.
Analysis of live, content-validated websites · vulnerability data from Wordfence Intelligence · snapshot 2026-07-25 · by Piperic
Share of measured WordPress sites running a known-vulnerable component — lower = more up-to-date. BY ranks #5 of 59 countries.
Neighbours shown for context. Full ranking in the data download.
BY's WordPress web measured against the global average — and its exposure to an end-of-life front-end library that stopped receiving security fixes in 2016.
These measures apply to every live BY website we analysed. They need no version detection, so they carry no selection bias.
Share of each platform's BY sites still on a release line for which the vendor has stopped shipping security fixes.
| Platform | Sites | On an unsupported line |
|---|---|---|
| Drupal | 520 | 62.9% |
| Joomla | 1,579 | 62.6% |
End of support: Joomla 3.x — August 2023 · Drupal 7 — January 2025 · Magento 1 — June 2020.
Share of measured BY WordPress sites running each plugin or theme in a version with a known vulnerability.
Among BY sites that run each of these popular components, the share on a version with a known vulnerability. Some stay current; page-builders and sliders lag.
Of BY sites running a vulnerable component, the worst-case severity (CVSS) present.
Share of measured BY WordPress sites with a known-vulnerable component, by industry.
| Sector | Sites | Vulnerable |
|---|---|---|
| Shopping | 164 | 79.3% |
| Automotive | 172 | 73.8% |
| Attractions | 188 | 48.4% |
Conservatively detected indicators on BY sites. Every figure is a LOWER BOUND — we only count what we can identify with high confidence, and we never name an individual website.
⚠ The implant we found most often runs only for a share of mobile visitors and opens a connection to an attacker-controlled host, which can then execute arbitrary code in the visitor's browser — a design that deliberately evades desktop security scans.
BY sites whose homepage prints server-side error messages or internal file paths — information that helps an attacker map the system.
Free, no signup — see what our index knows about any site:
How to cite: “According to Piperic's WordPress Security Report (2026-07-25), 73.9% of measured BY WordPress sites run a component with a known vulnerability…” — link to this page.
Download the country dataset (JSON) Global rankings dataset
Sample: measured BY WordPress sites (ccTLD-based assignment) where at least one plugin/theme version was readable from the homepage. Plugin/theme versions are cross-referenced against the Wordfence Intelligence vulnerability database (CVE-anchored). This measures update hygiene — running a version for which a vulnerability was disclosed — not exploitability. Homepage-only detection sees front-end components, not back-end plugins. All figures are aggregate; no individual site is identified. Snapshot 2026-07-25 (frozen). Vulnerability data © Wordfence Intelligence, MITRE where applicable.
Press contact: press@piperic.com · Data: Piperic Business Intelligence
Every number on this page is reproducible from the public dataset above.