Of 4,430 Hong Kong WordPress sites where we could read a component version, 3,260 (73.6%) run at least one plugin or theme in a version with a publicly known vulnerability. This measures patch hygiene — not that a site is exploitable.
Analysis of live, content-validated websites · vulnerability data from Wordfence Intelligence · snapshot 2026-07-25 · by Piperic
This report was produced without trying a password, scanning a port, probing a login form or sending one request an ordinary browser would not send. We asked each site for its homepage — exactly the way your browser does when you type the address — and read what came back. Everything below is what is visible from the outside, in Hong Kong and in 58 other countries.
Finding an outdated component on a website used to be work: you had to look, recognise, cross-check. That is the part that has changed. Reading a page, identifying a version and matching it against a vulnerability database is now a task a machine performs continuously, at the scale of the whole web. Of the Hong Kong WordPress sites we could measure, 61.3% run at least one flaw rated as requiring no privileges at all — no account, no password. That is not the hardest category to exploit. It is the easiest one to automate.
The threat is not that someone is targeting your website. It is that nobody has to.
Share of measured WordPress sites running a known-vulnerable component — lower = more up-to-date. Hong Kong ranks #6 of 59 countries.
Neighbours shown for context. Full ranking in the data download.
Hong Kong's WordPress web measured against the global average — and its exposure to an end-of-life front-end library that stopped receiving security fixes in 2016.
These measures apply to every live Hong Kong website we analysed. They need no version detection, so they carry no selection bias.
Global finding — measured across all 59 countries, not Hong Kong alone — We checked where those password forms actually send the password. Across the study, 89.1% of them submit it in plain text as well — the form posts back to the same unencrypted page. Only 5.1% post to an encrypted address, and even there the page itself can be rewritten in transit, because it arrived unprotected.
Share of each platform's Hong Kong sites still on a release line for which the vendor has stopped shipping security fixes.
| Platform | Sites | On an unsupported line |
|---|---|---|
| Joomla | 225 | 52.9% |
| Drupal | 344 | 41% |
End of support: Joomla 3.x — August 2023 · Drupal 7 — January 2025 · Magento 1 — June 2020.
Global finding — measured across all 59 countries, not Hong Kong alone — Across the whole study, visible defacement is 45.5× more prevalent on Joomla sites than on WordPress sites — while injected spam, on the very same pages, is only 1.3× more common, so the gap is specific to break-ins. This is a snapshot: it measures how many sites are visibly defaced right now, not how often they are broken into.
Share of measured Hong Kong WordPress sites running each plugin or theme in a version with a known vulnerability.
Among Hong Kong sites that run each of these popular components, the share on a version with a known vulnerability. Some stay current; page-builders and sliders lag.
The split follows one line: how the component got there. Components installed directly — listed in the admin panel, with an update button next to them — sit at the bottom of this list. Components that arrive bundled inside a purchased theme, where the owner may never see them listed at all, sit at the top. The risk is not the plugin you chose; it is the one you never knew you installed.
Of Hong Kong sites running a vulnerable component, the worst-case severity (CVSS) present.
Share of measured Hong Kong WordPress sites with a known-vulnerable component, by industry.
| Sector | Sites | Vulnerable |
|---|---|---|
| Business And Finance | 136 | 82.4% |
The same implant sits on 15,852 of the homepages we analysed, calling 2 attacker-controlled hosts and sending an identical hard-coded campaign ID from every one of them: this is a single operation, not a coincidence. The code first checks whether the visitor is on a desktop computer, and stays silent if so. On a phone it opens a channel to the operator's server and runs whatever that server sends back, inside the visitor's browser — so what actually happens is decided remotely, at the moment of the visit. In two thirds of the copies a random gate limits this to roughly every third visitor: another way to stay unnoticed.
Hong Kong: we measured no affected websites — which is not a clean bill of health.
⚠ These are not compromised businesses, and we do not count them as such. We profiled the sites carrying this code: 88% are Chinese-language adult, pirate-streaming or margin-trading sites and 99.8% run no recognisable content management system. It looks like a network monetising its own mobile traffic. We report it because the technique is what matters: it is the same evasion a real attack campaign would use, and it is invisible to desktop checks. Three quarters of the affected sites worldwide run on generic domains (.com, .net) that cannot be attributed to any country, so national counts are a floor, never a total. And the implant reacts to the visitor's device, not to the website's country.
Conservatively detected indicators on Hong Kong sites. Every figure is a LOWER BOUND — we only count what we can identify with high confidence, and we never name an individual website.
We profiled who carries these signals before publishing them: 74.2% run a recognisable content management system and 46% publish a phone number or an email address. These are working businesses with customers — a dermatology practice, a law firm, a charity — not abandoned domains. The front page of each one is quietly working for someone else.
⚠ The implant we found most often runs only for a share of mobile visitors and opens a connection to an attacker-controlled host, which can then execute arbitrary code in the visitor's browser — a design that deliberately evades desktop security scans.
Hong Kong sites whose homepage prints server-side error messages or internal file paths — information that helps an attacker map the system.
Free, no signup — see what our index knows about any site:
How to cite: “According to Piperic's WordPress Security Report (2026-07-25), 73.6% of measured Hong Kong WordPress sites run a component with a known vulnerability…” — link to this page.
Download the country dataset (JSON) Global rankings dataset
Sample: measured Hong Kong WordPress sites (ccTLD-based assignment) where at least one plugin/theme version was readable from the homepage. Plugin/theme versions are cross-referenced against the Wordfence Intelligence vulnerability database (CVE-anchored). This measures update hygiene — running a version for which a vulnerability was disclosed — not exploitability. Homepage-only detection sees front-end components, not back-end plugins. All figures are aggregate; no individual site is identified. Snapshot 2026-07-25 (frozen). Vulnerability data © Wordfence Intelligence, MITRE where applicable.
Press contact: press@piperic.com · Data: Piperic Business Intelligence
Every number on this page is reproducible from the public dataset above.