You Patch WordPress Weekly. Attackers Can Act in Five Hours
Five hours. That is the activity-weighted median time from disclosure to first exploit that Patchstack recorded in 2025 for the WordPress vulnerabilities attackers targeted most heavily (Patchstack, State of WordPress Security in 2026).
2nd Oct 2026