Is WordPress Outdated in 2026? What the Data Shows

No. WordPress is still the dominant CMS and has shipped two major releases since May. Its share of all websites has fallen 3.2 points in a year, though, and its real problems are plugin security and, more recently, governance. The evidence follows.

The market data

According to W3Techs (24 September 2026), WordPress is used by 40.2% of all websites and 58.8% of the websites whose content management system is known. Among the top 10,000 sites it is 51.7%, and among the top 100,000 it is 51.1%.

W3Techs' history report shows WordPress falling from 43.4% of all sites a year ago to 40.2% now, while sites with no CMS at all rose from 28.6% to 31.5%. We found no explanation on the page. By our arithmetic from those figures, every other CMS combined held about 28% of sites in both years, so the share moved to sites with no CMS, not to other CMSs.

Is the software still moving?

Yes.

• WordPress 7.0 "Armstrong" (20 May 2026) added a core AI Client, the Abilities API and a Command Palette. Release announcement.
• WordPress 7.1 "Mary Lou" (19 August 2026) added responsive styling controls in Global Styles and block settings, a new media editing modal, Notes with rich text and @mentions, new Playlist and Tabs blocks, and image processing in the browser. Release announcement.

The Interactivity API, introduced in WordPress 6.5, gives block developers a standard way to add front-end interactions.

Where WordPress has real problems

Plugin security

Patchstack's State of WordPress Security in 2026 reports 11,334 new vulnerabilities across the WordPress ecosystem in 2025, up 42% on 2024. Plugins accounted for 91% of them and themes for 9%. Core had six.

Since 91% of the reported vulnerabilities are in plugins, most known issues come through what you add to a site. Every installed plugin is code that someone has to keep patched, so a site with many plugins and no update process ages badly.

Governance

WP Engine sued Automattic and Matt Mullenweg in October 2024, after Mullenweg publicly criticised WP Engine, blocked its access to WordPress.org resources, and Automattic sent it trademark cease-and-desist letters. A federal judge granted a preliminary injunction in December 2024. In September 2025 the court let several of WP Engine's claims proceed and dismissed others. On 9 September 2026 Automattic's board placed Mullenweg on a leave of absence, and the case remains pending. Sources: TechCrunch's explainer, Computerworld on the injunction, Search Engine Journal on the September 2025 ruling and TechCrunch on the board's decision.

Our reading: this is a dependency risk a buyer should ask about, not a technical failure. Both releases above shipped while the dispute was running. What a buyer can control is their own code, their own hosting and how many plugins they depend on.

Old builds

A site that feels dated is often a build problem rather than a platform problem. Common symptoms are a page-builder theme that loads code the site never uses, plugins nobody has updated in years, no staging environment, and no one responsible for updates.

So should you choose WordPress in 2026?

It fits well for content-led sites, marketing sites, WooCommerce stores and any team that wants editors to work without a developer. It fits less well for a small site that never changes, where no CMS at all is a legitimate choice, and for products whose core is application logic rather than content.

If you already have a WordPress site that feels dated, the fix is often the build, not the platform. A custom theme replaces the page builder and maintenance keeps plugins patched. Headless WordPress is worth considering only when performance requirements have outgrown what a theme can do. Send us the site and we will tell you what it needs, or see what a project costs in How much does it cost to hire a WordPress developer?