On this page
The recurring WordPress security problems are exposed wp-login, outdated plugins (including phpunit debug files), XML-RPC, and stolen admin cookies. You can harden. You cannot make PHP+plugins vanish. Migrating to static Hugo and deleting WordPress removes that class of risk. That's Wordpress Escape.
November 2026: the update process itself is the hole
CVE-2026-119977 is an unauthenticated remote code execution bug in WordPress Core, affecting versions 4.7 through 7.1.3. It lives in the Core upgrade window: while an update runs, WordPress stages files in a predictable /wp-content/upgrade/ directory, and attackers race requests at it before the update finishes. WordPress patched it in 7.1.4 on October 28, and Wordfence reports blocking 240,000+ exploit attempts since.
Read that twice: the standard advice is “keep WordPress updated,” and this bug fires during the update. No plugin required. A static site has no upgrade staging directory to race. Full breakdown of the upgrade-window RCE →
2026 live example: php2shell, the interpreter bug
On October 21, 2026 the PHP project shipped emergency fixes for two unauthenticated remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. Every PHP build from 5.4 to 8.5.11 is affected. No plugin was involved, and no WordPress update fixes it.
It is the cleanest illustration of the point this page makes: the risk isn't only your plugins, it's the interpreter underneath them. Full breakdown of php2shell and what to patch →
The usual holes
- wp-login / xmlrpc brute force
- Plugin CVEs (the phpunit eval-stdin class of junk)
- Admin AJAX without capability checks
- World-writable uploads
Wordfence is a seatbelt. It is not a smaller car.
Why 'just keep it updated' fails
Someone has to click update, test the theme, and not install a nulled plugin. Small businesses don't have a security team. They have a site that books jobs. That's who we built this for.
Remove the surface
No PHP, no plugins, no wp-admin. HTML on Cloudflare. ESC'dashboard if you still want to edit. If you're already hacked, contain first, then migrate.
We'll tell you if wp-login is still there or if someone already static-exported and left fingerprints.
Frequently asked questions
Is WordPress insecure?
Core can be fine. The combination of plugins, PHP, and wp-login is a large attack surface compared to static HTML.
Does a static site get hacked?
The HTML files don't execute. Hosting accounts can still be stolen - but you dropped the most common WP exploit class.
Can I keep a WordPress-style editor?
Yes. ESC'dashboard is $189 once and writes static pages, not PHP.
See if WordPress is still live on your URL
Scan your URL free - 60 seconds, no login. SEO, Performance, Responsive grades, then a done-for-you escape if you want it.
Scan my site free