A WordPress plugin installed years ago, still running with no visible error, may nonetheless have become an entry point for an attacker without anything showing it in the dashboard. WordPress never warns you when a developer stops maintaining their extension, or when it gets removed from the official directory for security reasons. The site keeps running normally, which creates a false sense of security while the risk quietly builds up.
Why plugins are WordPress's real weak point
WordPress core software is maintained by a large, responsive team, and vulnerabilities found there are patched quickly. Plugins follow a very different logic: they are built by tens of thousands of independent authors, with widely varying levels of rigor, and a good share of them are maintained by a single person, sometimes on a volunteer basis. Year after year, specialized WordPress security reports converge on the same finding: the overwhelming majority of security flaws affecting WordPress sites come from plugins and themes, very rarely from the core software itself.
What separates an abandoned plugin from a simply quiet one
A plugin that hasn't received an update in a year or two is not necessarily dangerous, some very simple extensions simply don't need to evolve. The real warning signal to watch is twofold: the absence of updates for a long time, and the nature of what the plugin handles on your site. A plugin that processes forms, handles payments, or exposes a technical endpoint carries a risk in a different league than a simple display plugin, even if both have gone unmaintained for the same length of time.
How to spot a risky plugin
On your WordPress dashboard's plugins page, the last update date and the stated compatibility with the current WordPress version give a first clue. To go further, the WPScan database tracks the history of known vulnerabilities for each plugin and lets you check, by name, whether an extension has a track record of unpatched flaws. Some more comprehensive security extensions, such as Wordfence, also include an automatic scan that continuously compares installed versions against this database and alerts on a match.
What to do about an abandoned plugin
The right response depends on the specific situation. If a known security flaw exists and no fix has been published, the only reliable solution is to deactivate and delete the extension, then identify an actively maintained alternative. If the plugin has simply stopped receiving updates with no known flaw as of today, the risk is more diffuse but still real: without an active maintainer, a future flaw will never be patched. In that case, it is reasonable to plan its replacement over the medium term rather than in an emergency, prioritizing plugins that touch sensitive data or forms.
Limiting the number of installed plugins
Every activated extension expands the site's attack surface, whether it is actively used or not. A deactivated but not deleted plugin remains present on the server and can, in some cases, still be exploitable. Regularly reviewing the list of installed extensions, removing those no longer used, and avoiding several tools that fulfill the same function mechanically reduces the number of potential entry points.
A check that should become a habit
Checking available updates, reading changelogs before applying them, and occasionally consulting a vulnerability database for the site's most sensitive extensions does not require advanced skills, just a bit of regularity. On an older WordPress site, where extensions have piled up over the years, this check is worth doing thoroughly once rather than postponing it indefinitely.
Points to verify before publishing: confirm that the tools mentioned (WPScan, Wordfence) remain current and accessible references at the time of publication, and check that the definition of an abandoned plugin and the general statistics mentioned regarding the split of flaws between core, plugins and themes match the latest available security reports as of that date.