Hundreds of WordPress sites for years remain a convenient target not because of rare vulnerabilities, but because of older versions of PHP, forgotten extensions and settings that owners once left “by default”.
Kensys specialists studied the WordPress installations opened on the Internet and found that more than 70% of sites with visible information about PHP work on outdated versions of the server language. Only 14% of publicly available WordPress sites use the latest fixing of the content management system itself. Even if you consider WordPress 6.9, the support of which ended on March 20, 2026, the share of relevant settings reaches only 31%.
WordPress remains one of the most popular systems for launching sites without direct work with code. According to Censys, as of June 2026, the Internet shows more than 59 million web objects on WordPress, placed on more than 1 million different IP addresses. The problem is that the system itself can receive updates, and the server base under it has not changed for years.
The most common version of PHP among the studied sites was PHP 7.4. It is used by more than 20% of the resources, although support for PHP 7.4 ended in November 2022. For the site owner, the old version often looks like “works and okay”, but for attackers such a server becomes a predictable target with well-known errors.
A separate problem is created by WordPress extensions. As of June 2026, almost 7.5 million sites openly showed at least one installed extension. Even the popular Yoast SEO only has less than 22% of sites with a visible version worked on the latest issue 27.7 of May 27, 2026. Taking into account version 27.6, the figure rises to 40%, but most installations still remain outdated.
Extensions have their own risk zone. They are not checked as strictly as the kernel of WordPress, and popular additions have found many vulnerabilities over the years. Older versions can access data, allow you to bypass login or download malicious code. Attackers can also fake known extensions, buy abandoned projects or embed hidden access into them.
Censys cites an example of a MR.GREEN campaign, in which unknown people hack websites and replace the contents with the message “Hacked By MR.GREEN”. As of June 2026, experts have found more than 900 such spoiled sites. Almost all affected resources worked on content management systems, most often on WordPress.
Traces of such hacks were found back in 2020, but the campaign remains active. How exactly the attackers penetrated is unknown, but many affected sites have the same weaknesses: outdated software, an open WordPress installation page, an affordable xmlrpc.php file and remote access via SSH without strict restrictions.
The xmlrpc.php file refers to the old mechanism of remote WordPress management. If left open, the attackers can pick up passwords and look for installed extensions. GreyNoise data over the past 90 days shows 70 IP addresses that have actively scanned such entry points.
Judging by the observations of Censys, MR.GREEN does not always have a difficult goal. Attackers often simply leave a site with an inscription about hacking and standard WordPress theme. But even such a scenario shows how quickly small errors are at serious risk: an old version of PHP, a forgotten extension, an open service file and weak remote access settings together give attackers too many chances.
Censys specialists recommend updating not only WordPress, but also PHP, extensions, topics and server settings. PHP is supported for a limited period, so checking the availability of updates costs every 1-3 months, and install critical patches as soon as possible. For WordPress, it’s dangerous to blindly turn on automatic updates in total, but postponing fixes for years is even worse. The site may look ordinary and working, while the server underneath it gradually turns into an open door.
Kensys specialists studied the WordPress installations opened on the Internet and found that more than 70% of sites with visible information about PHP work on outdated versions of the server language. Only 14% of publicly available WordPress sites use the latest fixing of the content management system itself. Even if you consider WordPress 6.9, the support of which ended on March 20, 2026, the share of relevant settings reaches only 31%.
WordPress remains one of the most popular systems for launching sites without direct work with code. According to Censys, as of June 2026, the Internet shows more than 59 million web objects on WordPress, placed on more than 1 million different IP addresses. The problem is that the system itself can receive updates, and the server base under it has not changed for years.
The most common version of PHP among the studied sites was PHP 7.4. It is used by more than 20% of the resources, although support for PHP 7.4 ended in November 2022. For the site owner, the old version often looks like “works and okay”, but for attackers such a server becomes a predictable target with well-known errors.
A separate problem is created by WordPress extensions. As of June 2026, almost 7.5 million sites openly showed at least one installed extension. Even the popular Yoast SEO only has less than 22% of sites with a visible version worked on the latest issue 27.7 of May 27, 2026. Taking into account version 27.6, the figure rises to 40%, but most installations still remain outdated.
Extensions have their own risk zone. They are not checked as strictly as the kernel of WordPress, and popular additions have found many vulnerabilities over the years. Older versions can access data, allow you to bypass login or download malicious code. Attackers can also fake known extensions, buy abandoned projects or embed hidden access into them.
Censys cites an example of a MR.GREEN campaign, in which unknown people hack websites and replace the contents with the message “Hacked By MR.GREEN”. As of June 2026, experts have found more than 900 such spoiled sites. Almost all affected resources worked on content management systems, most often on WordPress.
Traces of such hacks were found back in 2020, but the campaign remains active. How exactly the attackers penetrated is unknown, but many affected sites have the same weaknesses: outdated software, an open WordPress installation page, an affordable xmlrpc.php file and remote access via SSH without strict restrictions.
The xmlrpc.php file refers to the old mechanism of remote WordPress management. If left open, the attackers can pick up passwords and look for installed extensions. GreyNoise data over the past 90 days shows 70 IP addresses that have actively scanned such entry points.
Judging by the observations of Censys, MR.GREEN does not always have a difficult goal. Attackers often simply leave a site with an inscription about hacking and standard WordPress theme. But even such a scenario shows how quickly small errors are at serious risk: an old version of PHP, a forgotten extension, an open service file and weak remote access settings together give attackers too many chances.
Censys specialists recommend updating not only WordPress, but also PHP, extensions, topics and server settings. PHP is supported for a limited period, so checking the availability of updates costs every 1-3 months, and install critical patches as soon as possible. For WordPress, it’s dangerous to blindly turn on automatic updates in total, but postponing fixes for years is even worse. The site may look ordinary and working, while the server underneath it gradually turns into an open door.
