Certificate, browser protections, displayed versions, DNS: the check reads these public signals, assigns a score and ranks the first fixes.
Time to act
For the September 22 vulnerability, the first attempts were observed within hours. Between the patch’s release and its installation, your site stays exposed to that flaw.
The patch ships
WordPress 7.1.2, plus security updates for earlier branches.
wordpress.orgThe first attempts
Patchstack blocks exploitation attempts the same day.
PatchstackThe flaw enters the CISA catalog
CISA lists it in its catalog of exploited vulnerabilities.
CISA KEVCompare for yourself
The patch waits
30days
of possible waiting before your next update.
During this time, the vulnerability stays open.
Illustration of the chosen schedule. The actual delay depends on the software, your settings and whether the installation succeeds.
Every day gained shortens the wait. Turn on automatic updates and check that they install.
Minor updates to WordPress core install themselves by default; plugin updates only if you turn them on.
The response, annotated
The sample site’s response, as a bot reads it. Tap a line to see what it protects or what it exposes, then look at it after the fix.
HTTP/1.1 200 OKcontent-type: text/html; charset=UTF-8WordPress, in 2025
Most of them affect plugins. When the same vulnerable plugin runs on several sites, a bot can spot and test them at scale. The grid shows this exact case across forty sites.
91%of vulnerabilities are in plugins, 9% in themes
+42%in a year: 7,966 vulnerabilities in 2024
46%still had no patch on the day they were published
Patchstack, State of WordPress Security in 2026 (2025 data), published Feb 25, 2026; W3Techs, snapshot of Sep 28, 2026.
WordPress runs 40% of the web. Each site combines a shared core, a theme and plugins, with as many update schedules to keep up with.
A WordPress siteThe core, a theme and plugins, each written by a different author.
An EnixLab custom-built siteWritten for your site, using a small set of carefully selected components that we monitor.
A WordPress siteThe core, the theme and each plugin follow their own schedule; someone has to test and install the updates.
An EnixLab custom-built siteWe test and deploy them as part of ongoing maintenance.
A WordPress siteSites running the vulnerable plugin can be spotted and tested in bulk.
An EnixLab custom-built siteA campaign aimed at a WordPress plugin misses code specific to the site; its shared building blocks stay tracked.
A WordPress siteAn admin interface provided by the CMS and its plugins, to be configured and maintained for each role.
An EnixLab custom-built siteAn admin interface limited to the useful functions, with permissions set as tightly as possible.
Custom-built software has its own flaws. Its advantage is a smaller codebase that we understand and monitor, along with its dependencies.
Check, or audit
The online check
Eighteen points that are publicly accessible.
About a minute, free, from public information
An EnixLab audit
Your code, your accounts and your configuration.
Under a signed agreement
You now know your site’s public signals. An audit then checks the plugins, accounts, forms and backups, and ranks the fixes by urgency.
This page’s check is passive: it reads what the site sends to any visitor. Its scope stops at these public signals.
Figures collected between September 28 and 29, 2026.