Abandoned Plugins: The Quiet WordPress Plugin Security Risk

When I looked after client sites, the most common problem I found was not dramatic. It was a plugin that had been installed years earlier for some forgotten reason, was still active, and had not been updated by its developer in a long time. Nobody noticed, because nothing was visibly broken.

That is what makes abandoned plugins the quiet risk on most sites.

Where the risk really is

People often worry about WordPress itself being insecure. The numbers point elsewhere. Patchstack, which tracks security issues across the WordPress ecosystem, reported 11,334 new vulnerabilities in 2025. Of those, 91% were in plugins and 9% in themes. Only six were reported in WordPress core.

A second figure from the same report matters even more. Patchstack found that 46% of vulnerabilities did not receive a fix by the time they were disclosed. In other words, for almost half of the problems found, there was no update to install when the problem became public.

If that is the situation with plugins whose developers are still active, think about the plugins whose developers are not. A vulnerability in an abandoned plugin may never be fixed at all.

How to recognise an abandoned plugin

There is no single label, but the signs are clear enough:

• The last update was a long time ago. On a plugin’s WordPress.org page, the “Last updated” date tells you when its developer last released anything.
• The compatibility warning. WordPress.org shows a notice on plugins that have not been updated in a while: “This plugin hasn’t been tested with the latest 3 major releases of WordPress.” It does not mean the plugin is broken, but it does mean nobody has confirmed it still works.
• Unanswered support threads. If questions in the plugin’s support forum go unanswered for months, nobody is minding the shop.
• It has disappeared from the directory. Plugins can be closed on WordPress.org for various reasons. If you cannot find yours any more, find out why.

What to do about it

Every few months, go through the plugins on your site with these questions:

1. Do I still use it? If not, deactivate and delete it. An inactive plugin’s files can still be present on the server, so deleting is better than deactivating.
2. Is it still maintained? Check the last update, the compatibility notice and the support forum.
3. Is there a maintained alternative? If the plugin is abandoned but you need what it does, replace it with one that is looked after.
4. Does something else already do the job? Many sites run several plugins that overlap. Fewer plugins means fewer things to keep current.

And keep everything that remains updated: WordPress, the theme and the plugins.

How this shaped what I build

This is one of the reasons I prefer a small set of tools that each do a clear job. My themes and the TWA AEO plugin cover structure, structured data, AI crawler settings, redirects and several other things that sites often handle with a separate plugin each. Fewer plugins does not just make a site faster. It makes it easier to keep current, which is my fourth rule: it is kept current.

It is also why maintenance matters to how I sell the paid versions. A plugin whose developer is paid to keep it updated is less likely to become one of the abandoned ones. I explain that in Free vs Premium WordPress Plugins: When It’s Worth Paying.