AI is squeezing websites from both sides. On one side, attackers are using AI to find and exploit vulnerabilities faster than any human team ever could. On the other, a wave of developers and agencies are using AI to build websites and plugins without fully understanding the code it generates. More vulnerabilities are being created at the same time more vulnerabilities are being exploited. That gap is the story of web security in 2026, and it's why a lot of websites need more than a security update. They need a rebuild.

The vise

Here's the problem nobody's talking about clearly enough.

AI has given all of us super powers. And while the bad guys are using these powers to hack our sites, unqualified vibe coders are building websites with no knowledge of security and software best practices. More holes are being created. Better tools exist to find them. And this is setting us up for a perfect storm.

Patchstack calls it "vibe coding" in their 2026 State of WordPress Security report, and they flag it as a direct contributor to the acceleration of WordPress vulnerabilities. People without sofware engineering schooling are rapidly diving into deeper and deeper waters... where they do not belong. Sure it might look cool and does what they asked, but the viber can't always tell you whether it sanitizes inputs properly, whether it exposes the database to injection, or whether it grants permissions it shouldn't. They can't audit what they didn't write and don't fully understand.

This isn't just freelancers cranking out cheap plugins or websites. Agencies are doing it. Internal teams are doing it. And the WordPress plugin ecosystem, which saw 11,334 new vulnerabilities in 2025 (up 42% from 2024), is filling with more plugins filled with holes. Ninety-one percent of those vulnerabilities were in plugins. WordPress core had six all year. The plugin ecosystem had 11,328.

Now match that against the attack side. IBM's X-Force 2026 Threat Intelligence Index found a 44% increase in attacks starting with exploitation of public-facing web applications. AI-enabled vulnerability discovery was cited as a primary driver. The Verizon 2025 DBIR analyzed over 22,000 incidents and 12,000 confirmed breaches. Credential abuse, phishing, and vulnerability exploitation remain the top entry points, but the speed and precision of all three are increasing because of AI.

That's the vise. One side produces more vulnerable code faster. The other side finds and exploits it faster. And the people in the middle, the businesses running these websites, are getting squeezed.

How fast the attack side moves now

In April 2026, Anthropic released Claude Mythos Preview. It's a frontier AI model, not specifically built for security, but during testing it demonstrated the ability to autonomously discover thousands of zero-day vulnerabilities across every major operating system and every major web browser. It found a 27-year-old bug in OpenBSD, an operating system famous for its security hardening. A 16-year-old memory flaw in FFmpeg. Errors in TLS and SSH libraries that could enable certificate forgery. It achieved a 72% success rate generating working exploits for real software, up from under 5% for prior models.

If a model can find bugs that expert human researchers missed for 27 years, the WordPress plugin your developer shipped last Tuesday doesn't stand a chance.

As you're likely aware, Anthropic restricted Mythos to a defensive consortium called Project Glasswing. They know what they built. But the underlying techniques are being replicated, and the gap between restricted frontier models and openly available ones shrinks every quarter.

This isn't entirely new. Back in November 2025, Anthropic disclosed that a Chinese state-sponsored group had already manipulated their Claude Code tool to run an espionage campaign against roughly 30 organizations. The AI handled 80 to 90 percent of tactical operations on its own: discovering vulnerabilities, mapping networks, extracting data, categorizing intelligence. Human involvement totaled about 20 minutes. Separately, Anthropic's August 2025 threat report documented a person with basic coding skills who used Claude to develop and sell functional ransomware on the dark web. Without the AI's help, they couldn't have built it.

The UK's National Cyber Security Centre offers a fair counterweight: fully autonomous end-to-end cyberattacks are unlikely before 2027. There's still a human in the loop for most of what's happening today. But the floor has dropped hard. As Microsoft's threat intelligence team said at RSAC 2026, what once required the resources of a nation-state is now accessible to a motivated individual with the right tools.

Five hours

For anyone managing WordPress sites, here's the number that changes everything.

Patchstack's 2026 report puts the median time from public vulnerability disclosure to mass automated exploitation at 5 hours. Five hours between "a vulnerability is announced" and "bots are actively hitting every site running that plugin." And 46% of the vulnerabilities disclosed in 2025 had no patch available at the time. Nearly half. Even if you're on top of updates, for almost half of these flaws there was nothing to update to.

Highly exploitable vulnerabilities, the kind used in automated mass attacks, increased 113% year over year. More were found in 2025 than in the previous two years combined.

Think about what that means in the context of the vise. A developer uses AI to build a plugin. They ship code they can't fully audit. A vulnerability researcher (or an AI scanner, or an attacker) finds the flaw. It gets disclosed. Within 5 hours, bots are probing every site running that plugin. And if there's no patch yet, which happens 46% of the time, the only thing standing between that site and a breach is whatever perimeter defense the site owner happened to have in place.

The plugin you trust could be the one that gets you

On April 5, 2026, someone activated dormant backdoors across more than 30 WordPress plugins with over 400,000 combined installations. These were EssentialPlugin suite extensions: countdowns, testimonials, sliders. Common stuff that agencies install on client sites without a second thought.

In August 2025, a buyer identified only as "Kris," with a background in SEO, crypto, and gambling, purchased the whole portfolio on Flippa for six figures. The first code commit after the purchase included 191 lines of PHP containing a deserialization backdoor, hidden behind a changelog entry that read "Check compatibility with WordPress version 6.8.2."

Then nothing. Eight months of dormancy. No malicious activity. No red flags.

On April 5, 2026, a command-and-control server started distributing payloads. The code injected itself into wp-config.php and served cloaked SEO spam visible only to Googlebot. Site owners saw a perfectly normal website. Search engines saw a compromised one.

WordPress.org closed all 31 plugins on April 7 and pushed forced updates. But those updates only disabled the phone-home function. They didn't remove the backdoor code or clean wp-config.php. Anyone who had these plugins installed between August 2025 and April 2026 needs manual remediation. The same week, Smart Slider 3 Pro (800,000 installations) was separately compromised through its own update infrastructure.

Here's the structural gap: WordPress has no mechanism to review plugin ownership transfers, no notifications to users when ownership changes, and no code review triggered by new committers. The buyer's Flippa listing was public. WordPress.org granted SVN commit access immediately.

And the vibe coding problem makes this worse. When agencies and developers are installing plugins built by people who used AI to write code they can't audit, and those plugins can change ownership without anyone being notified... what exactly is the chain of trust here? Who actually understands what's running on these sites?

Your credentials are already out there

One more door that's wide open. Picture this: a team member checks personal email on their work laptop, clicks a link that looks legitimate, and an infostealer quietly harvests every saved password, session cookie, and autofill entry from their browser. Within hours those credentials are packaged on a dark web marketplace. An attacker buys the bundle, finds your agency's WordPress management dashboard, intercepts the SMS two-factor code through a SIM swap, and now owns every client site you manage through that dashboard.

That's not a hypothetical. It's the pattern documented across the Verizon DBIR's 22,000 incidents. Credential abuse was the initial vector in 22% of all breaches. In basic web application attacks, 88% involved stolen credentials. Flashpoint counted 1.8 billion credentials stolen by infostealers in the first half of 2025 alone.

MFA isn't the safety net it used to be either. The Tycoon2FA platform ran as a subscription phishing service, tens of millions of emails per month, linked to nearly 100,000 compromised organizations. It specialized in adversary-in-the-middle attacks that intercept credentials and session tokens in real time, beating standard MFA completely.

What to do right now (and why it's not enough)

You can't wait for a rebuild to start protecting what you have. These are the layers that matter most today. No single one is sufficient, but together they make you a much harder target.

Put a WAF at the edge. Cloudflare, Sucuri, or equivalent, sitting in front of your site, blocking known exploits before they reach the server. When a new plugin flaw drops, these services deploy virtual patches within hours. For the 46% of vulnerabilities with no patch at disclosure, this is your only protection. We run this on every client site. It's not optional.

Audit your plugins ruthlessly and watch for ownership changes. Remove anything inactive or abandoned. If a plugin hasn't been updated in six months, it's a liability. After EssentialPlugin, watching for developer name changes in update changelogs is baseline due diligence. Challenge whether you actually need 25 plugins or whether 10 would do the job. Every one is an attack surface.

Fix authentication and harden the CMS. MFA for every admin account, no exceptions. Passkeys (FIDO2/WebAuthn) if possible, because there's no credential to steal and no code to intercept. At minimum, app-based authenticator codes, not SMS. Change the default login URL. Kill the "admin" username. Move wp-config.php above the web root. Disable dashboard file editing, XML-RPC, and unnecessary REST API endpoints. Set proper file permissions. Boring stuff. Stops the majority of automated attacks.

Automate backups and make one copy untouchable. Store them offsite. Make at least one copy immutable so ransomware can't encrypt your safety net. Test restores. Regularly. Cyber insurers are now requiring proof of backup integrity and tested restoration before issuing policies. An untested backup is not a backup.

Monitor and have a plan. File integrity monitoring, login alerts, Google Search Console watching for SEO spam (exactly what EssentialPlugin deployed). Have an incident response plan written down. When something breaks, you've got hours, not days. Vermont's Security Breach Notice Act gives you 14 days to notify the Attorney General, one of the fastest windows in the country.

All of that is necessary. Every bit. But I want to be straight with you.

Your website wasn't built for this

If your site was assembled from 25 or 30 plugins, some built by developers who vibe-coded them with AI, running on shared hosting with default configurations, you don't just have a security problem. You have a structural problem. And you can't patch your way out of a codebase that nobody fully understands.

I've been building websites for 28 years. I watched this industry go through mobile, responsive design, accessibility, and SEO. Every one of those waves changed what a website needed to be, structurally. When mobile hit, you couldn't just shrink a desktop site. You had to rebuild for a different medium. The businesses that understood that early pulled ahead. The ones that resisted had to do it anyway, just later and at higher cost.

We're there again. And this time the forces are converging from four directions at once.

Security, AIO, SEO, and accessibility aren't four separate problems. They're the same problem. They all depend on the same foundation: clean semantic HTML, proper structure, minimal attack surface, solid authentication, and hosting that isolates your site from everyone else's problems.

We've been writing about how AI agents are becoming a primary way people find information and services. Those agents don't browse like humans. They parse your structure, your metadata, your semantic markup. A site that AI agents can't read is a site that's invisible to a growing share of your potential traffic.

We've been writing about how WCAG accessibility and AI readiness converge. The accessibility tree that screen readers depend on is the same structure AI agents use to understand your content. A website that's accessible is a website that's machine-readable. That's not a nice bonus. It's becoming table stakes.

SEO is shifting the same direction. Search engines reward sites with clean technical foundations, structured content, fast performance, and yes, solid security posture. The old playbook of keyword-stuffed content and link building is losing ground to sites that are genuinely well-built.

A website built for the Agentic Web has 8 plugins instead of 30. It runs on isolated hosting instead of shared. Authentication uses passkeys instead of passwords. Structure is semantic HTML that AI agents, screen readers, and search crawlers can all parse cleanly. It's WCAG compliant from the ground up, not patched after launch. And every line of code is understood by the people who built it, not generated by an AI and shipped on faith.

That last part is the real differentiator in 2026. Not which CMS you use. Not which theme you pick. Whether the people building and maintaining your site actually understand what the code does. At Propeller, our team ranges from 9 to 17 years together, with decades of individual experience before that. We understand the code. And through Accessibility.Works, we understand the structural requirements that make a site work for humans, machines, and yes, the AI agents that are rapidly becoming your most frequent visitors.

The agencies and businesses that understand this convergence and act on it will pull ahead. The rest will catch up eventually. That's how every major web transition has played out.

Gretzky skated to where the puck was going. The puck is going to the Agentic Web. The question is whether your site is built for where things are headed or where they've already been.

Want to talk about what a rebuild looks like? Get in touch. We'd rather have that conversation now than after the next vulnerability hits.