# Why SaaS Is a Better Choice Than WordPress in the AI Era

The critical wp2shell vulnerability shows why maintaining WordPress is becoming harder in the AI era—and why managed SaaS platforms offer a safer alternative.

For years, WordPress has been the default choice for businesses that want flexibility and control. Its open-source foundation and enormous plugin ecosystem make it possible to build almost anything.

But flexibility comes with a cost: every theme, plugin, integration, administrator account and server component expands the security surface that someone must continuously protect.

The discovery of wp2shell, tracked as CVE-2026-63030, demonstrates how serious that responsibility has become. In an era when attackers can use AI to analyze code, automate reconnaissance and scan thousands of websites, the traditional self-managed WordPress model is increasingly difficult to defend.

What is the wp2shell vulnerability?

According to Rapid7’s vulnerability report, wp2shell is a critical, unauthenticated remote-code-execution vulnerability in WordPress core.

The vulnerability reportedly allows an attacker to reach a vulnerable WordPress site through its REST API batch endpoint and execute code without a valid account or any action from the site owner. Successful exploitation could lead to complete compromise of the website and its underlying data.

Affected releases include:

• WordPress 6.9.0 through 6.9.4

• WordPress 7.0.0 through 7.0.1

The issue has been fixed in WordPress 6.9.5 and 7.0.2. WordPress administrators should verify that affected installations have actually received the appropriate security update. WordPress has also confirmed the fix in its 7.0.2 release announcement.

This particular vulnerability exists in WordPress core and can reportedly affect a default installation without requiring a vulnerable plugin. That distinction matters: even a carefully selected plugin stack cannot eliminate the operational responsibility of securing the underlying CMS.

WP Engine had to intervene for its customers

Following the disclosure, WP Engine sent users a security email explaining that it had proactively upgraded affected sites to a secure WordPress release, such as version 7.0.2. Its message told customers:

“We’ve taken the proactive step of upgrading your site(s) to the latest secure version of WordPress.”

That is good incident response. It also illustrates an important point: many WordPress owners depend on hosting companies, developers or security services to notice vulnerabilities and apply emergency fixes on their behalf.

Customers using less proactive hosting—or sites on which updates fail because of compatibility problems—may not receive the same protection.

With a true SaaS platform, centralized security updates are part of the product model. Customers do not each maintain separate copies of the application. The provider can test, patch and monitor the shared platform without asking thousands of individual site owners to coordinate emergency upgrades.

WordPress security is bigger than WordPress core

WordPress is not inherently insecure simply because it is open source. Open-source development allows defenders to review code, discover problems and contribute fixes.

The challenge is the combination of openness, enormous scale, decentralized maintenance and virtually unlimited extensibility.

A typical WordPress site is assembled from software created by multiple independent parties:

• WordPress core

• A hosting and server stack

• A theme

• Page-building software

• Membership or learning-management plugins

• Payment and ecommerce extensions

• Form, analytics, SEO and marketing plugins

• Custom code written by agencies or freelancers

Each component has its own developers, release schedule, coding standards and commercial incentives. The site owner becomes responsible for ensuring that every piece remains secure and compatible with everything else.

Patchstack’s 2025 vulnerability statistics attribute approximately 91% of recorded WordPress ecosystem vulnerabilities to plugins and another 9% to themes. The figures do not mean every WordPress plugin is unsafe, but they show where most of the ecosystem’s disclosed security burden resides. View the Patchstack statistics.

How one plugin can expose another

Plugins do not operate as completely isolated applications. They commonly share the same WordPress runtime, database, user accounts, files, hooks and administrative privileges.

As a result, a weakness in Plugin A can sometimes expose data or functionality belonging to Plugin B. For example, a vulnerable plugin might allow an attacker to:

• Create or promote a WordPress administrator

• Change shared configuration values

• Steal authentication tokens or API credentials

• Modify another plugin’s files

• Upload executable PHP code

• Invoke insecure functions registered by another component

• Inject JavaScript into pages generated by a different plugin

The original weakness may appear small, but an attacker can combine it with permissions or functionality elsewhere on the site. Security professionals call this an attack chain: several individually limited weaknesses are connected to produce a much more serious compromise.

The more independent components a site installs, the more combinations its owner must secure and test.

Plugin ownership is another supply-chain risk

Installing a plugin establishes an ongoing relationship of trust. Future updates may execute code from that plugin’s developer directly on the website.

That trust can become dangerous if a developer account is compromised or a plugin changes ownership.

In 2024, compromised WordPress.org developer accounts were used to distribute malicious updates through multiple plugins. The injected code created administrator accounts and delivered spam, cryptocurrency miners and other malicious payloads. Wordfence’s investigation found that reused credentials from previous breaches enabled the incident.

There have also been documented cases in which malicious actors purchased existing plugins and subsequently added backdoors. Wordfence reported three such plugin acquisitions used to distribute SEO spam through affected websites. Read the supply-chain report.

This does not mean ordinary plugin acquisitions are malicious. Most are legitimate business transactions. It means ownership, developer credentials and update infrastructure are all parts of the software supply chain—and therefore part of the site’s security risk.

AI changes the economics of attacking websites

Automated vulnerability scanning existed long before generative AI. AI does not magically make every attacker an elite security researcher, but it can reduce the time and skill required for several stages of an attack.

AI-assisted tools can help attackers:

• Analyze publicly available source code

• Compare patched and unpatched releases

• Generate variations of exploit code

• Identify websites running particular software versions

• Automate reconnaissance and repeated probing

• Adapt payloads based on error messages

• Operate bots continuously across large numbers of targets

Rapid7 specifically warned that the availability of WordPress source code, combined with AI’s ability to analyze it, could accelerate the appearance of a public proof-of-concept for wp2shell.

This is the critical change. Website owners are no longer competing only against individual hackers manually investigating one target at a time. They face automated systems that can repeatedly inspect large parts of the internet and exploit a weakness wherever patching has fallen behind.

Why the SaaS model is better suited to this environment

A well-managed SaaS platform reduces the number of security decisions pushed onto each customer.

Instead of asking every organization to maintain its own application stack, the SaaS provider can:

• Apply security fixes centrally

• Monitor one controlled application environment

• Enforce consistent configurations

• Limit unsupported third-party code

• Test integrations before deployment

• Detect suspicious activity across the platform

• Maintain backups and recovery procedures

• Respond to incidents without relying on every customer to act

This does not make SaaS invulnerable. A SaaS provider can still contain software flaws, suffer a supply-chain incident or become an attractive centralized target. Customers should evaluate its security practices, data controls, backup strategy and incident-response record.

The advantage is clearer accountability. Instead of coordinating a host, theme author, numerous plugin developers, an agency and internal administrators, the customer has one provider responsible for maintaining the application.

The real choice is responsibility

WordPress remains a powerful option for organizations with experienced developers, disciplined plugin governance, continuous monitoring and the ability to respond quickly to security advisories.

But many businesses do not want to operate a software supply chain. They want to publish content, sell courses, manage customers and grow their business.

For those organizations, the question is no longer simply:

“Can WordPress build what we need?”

It almost certainly can.

The more important question is:

“Do we want to remain responsible for securing every component required to build it?”

In the AI era, vulnerabilities can be studied and targeted faster than ever. The wp2shell disclosure is another reminder that delayed patching, abandoned extensions and fragmented responsibility are no longer minor technical inconveniences.

A purpose-built SaaS platform removes much of that operational burden. It allows businesses to focus on their customers while a dedicated platform team handles updates, monitoring, compatibility and security behind the scenes.

That is why SaaS is not merely more convenient than WordPress. For many modern businesses, it is the more sustainable security model.