Wordfence 2024: 54 billion malicious requests blocked, ~325-350k sites infected on any given day

Claims (Wordfence 2024 Annual WordPress Security Report, April 8, 2025):

• "Wordfence blocked and logged over 54 billion malicious requests, and blocked over 55 billion password attacks in 2024"
• "In 2024, 8,223 vulnerabilities were published… roughly a 68% increase from 2023"
• "Plugin vulnerabilities remain the biggest software threat to WordPress, accounting for 96% of all vulnerabilities disclosed" (only 5 affected core)
• "Roughly 35% of the vulnerabilities disclosed in 2024 remain unpatched in 2025"
• "Wordfence saw just under one million distinct sites infected with malware… roughly 325,000 - 350,000 infected sites on any given day"

Source: https://wordfence.com/blog/2025/04/2024-annual-wordpress-security-report-by-wordfence/

Confidence: Verified.

This is the ambient background radiation an unmaintained WordPress site is exposed to. The +68% YoY growth in disclosed vulns means the maintenance burden of any large plugin stack is itself growing. Related: Patchstack 2024: 4,166 new vulnerabilities, 96% in plugins, 4% in themes, only 7 in core, Patchstack 2024: 1,614 plugins and themes removed from .org repo for unpatched security issues.