Abandoned WordPress Plugins: 5 Warning Signs Your Site Is Running One

Somewhere on your WordPress site, there’s probably a plugin you installed years ago and haven’t thought about since. It still does its job. The contact form sends. The gallery loads. Nothing looks broken.

That’s exactly why abandoned plugins are dangerous. Nothing looks broken.

In 2024, WordPress.org removed 1,614 abandoned plugins and themes from its official directory after developers stopped responding to security reports, according to Patchstack’s State of WordPress Security report. Of those, 1,450 contained vulnerabilities rated high or medium severity. And the sites already running those plugins? Most of their owners never found out.

As of August 2026, Vimsy’s Plugin Graveyard tracks 87 plugins with over 1,000 installs each that haven’t received an update in more than a year. 45 of them have documented security vulnerabilities. Together, they’re running on more than 3.9 million websites.

This article explains what an abandoned plugin actually is, how to spot one in about two minutes without any technical knowledge, and why “it still works” is the most expensive sentence in WordPress.

What is an abandoned WordPress plugin?

A plugin is a piece of software written by a developer, and like all software, it needs ongoing care. WordPress itself changes several times a year. PHP, the language WordPress runs on, changes too. Security researchers keep finding new flaws in old code. A responsible developer releases updates to keep pace with all of it.

An abandoned plugin is one where the developer has walked away. No more updates. No more security patches. No one reading the support forum. The plugin keeps running on your site, frozen at whatever state it was in the day its developer moved on.

There’s no official announcement when this happens. Developers rarely post a goodbye note. They just stop, and the only evidence is silence.

Security researchers generally treat 12 months without an update as the point where risk starts climbing, and 2 years as a serious red flag. WordPress.org draws a line at two years: plugins that go longer without updates get flagged in the plugin directory and can be excluded from search results.

Why an abandoned plugin matters even if it still works

Here’s the comparison that makes it click: an abandoned plugin is like a door with a lock that was recalled years ago. The door still opens and closes. The lock still turns. But locksmiths have published exactly how to pick it, the manufacturer is gone, and no replacement part is coming.

“Working” and “safe” are two different measurements. A plugin can do its visible job perfectly while containing a flaw that lets an attacker create an admin account, inject spam links into your pages, or install malware that infects your visitors. You wouldn’t see any of it happen. Modern attackers don’t break sites; they use them quietly for as long as possible.

The numbers back this up. Patchstack identified 7,966 new vulnerabilities across the WordPress ecosystem in 2024, a 34% increase over the previous year, and 96% of them were in plugins. Not WordPress core. Plugins.

When a vulnerability is found in a maintained plugin, the developer ships a patch, you click update, done. When the same thing happens in an abandoned plugin, the vulnerability becomes public knowledge and the patch never arrives. Every site running it becomes a standing target, and attackers scan for these plugins specifically because they know the hole will stay open.

What that looks like in practice: the Eval PHP case

In April 2023, security firm Sucuri documented a mass campaign abusing a plugin called Eval PHP. Its last real update had come 11 years earlier, and it was still sitting in the official WordPress directory.

Attackers used it to plant backdoors on thousands of compromised websites. Daily downloads of the plugin jumped from around 40 to over 100,000 in a matter of weeks — almost none of them from legitimate users. The backdoors were hidden inside draft posts, invisible to site owners, and let attackers re-enter cleaned sites again and again.

A plugin nobody had maintained for over a decade became the delivery mechanism. That’s the pattern: abandoned code doesn’t just sit there aging. It gets found, and then it gets used.

How to check if a plugin is abandoned: 5 warning signs

You don’t need a developer for this. Every sign below is visible on the plugin’s public page at WordPress.org. To find that page, search the plugin’s name plus “WordPress plugin,” or go to your WordPress dashboard, open Plugins, and click the “View details” link under any plugin’s name.

1. The last update was more than 2 years ago

Every plugin page shows a “Last updated” date in the sidebar. This is the single fastest check. Under a year: normal. One to two years: worth watching. Over two years: treat it as abandoned until proven otherwise, even if the plugin is popular. Limit Login Attempts, a security plugin still active on more than 300,000 sites, hasn’t been updated since 2023 and now carries four known vulnerabilities, including critical ones.

2. The “untested” warning is showing

If a plugin’s page says it “hasn’t been tested with the latest 3 major releases of WordPress,” that means the developer hasn’t even updated a single line in a text file to confirm compatibility. That’s the lowest-effort signal of life a developer can give, and they haven’t given it. WordPress itself notes these plugins “may no longer be maintained or supported.” The warning isn’t proof of abandonment on its own, but combined with an old update date, it usually is.

3. The support forum has gone quiet

Every plugin page has a Support tab. Open it and look at two things: are people asking questions, and is anyone answering? A healthy plugin shows recent threads marked “resolved.” An abandoned one shows a wall of unanswered questions, often stretching back months or years, sometimes with users asking directly, “Is this plugin still maintained?” into the void.

4. The developer has disappeared

Click the developer’s name on the plugin page. Does their website still exist? Do their other plugins show recent updates? A developer whose entire catalog went stale at the same time has left WordPress, and every plugin they built left with them. OptionTree, still installed on 50,000+ sites, last saw an update in 2019 and carries five known vulnerabilities.

5. The plugin has been closed or removed

The starkest sign: the plugin’s page says “This plugin has been closed and is no longer available for download.” WordPress.org closes plugins for unresolved security issues or abandonment. Here’s the part almost nobody knows: your site is not notified when this happens. The plugin keeps running, update checks silently return nothing, and your dashboard shows no warning at all. Sites have run closed, vulnerable plugins for years without their owners having any way to know.

What to do if you find one

First, don’t panic-delete everything. An abandoned plugin means elevated risk, not a confirmed hack. Work through it in order:

If the plugin has a known vulnerability, remove it now. Deactivate and delete it. Deactivating alone isn’t enough — the vulnerable code stays on your server and some flaws are exploitable even in inactive plugins.

If it’s abandoned but has no documented flaw, ask whether you still need it. Plenty of plugins from 2018 do things WordPress now does natively. If you do need the function, nearly every abandoned plugin has an actively maintained alternative doing the same job.

Before deleting anything, take a backup. If removing a plugin changes something on your site, you want a way back.

Then make this a habit, not a one-time cleanup. Plugins that are healthy today get abandoned tomorrow. A once-a-quarter review of your plugin list takes fifteen minutes.

Check your plugins against the Graveyard

Checking each plugin by hand works, but it’s tedious, and the risk picture changes monthly as new plugins go stale and new vulnerabilities get published.

That’s why we built the WordPress Plugin Graveyard: a free, live directory of unmaintained plugins, each with its last update date, known vulnerability count, severity rating, and how many sites are still running it. Data comes from the WordPress.org API and the Wordfence Intelligence vulnerability database, and it refreshes on the 1st of every month.

Open your WordPress dashboard, open the Graveyard next to it, and compare your plugin list against ours. If you find a match, you’ll know the risk level immediately. If you find several, a free WordPress audit will give you a full picture of what to remove, what to replace, and what’s fine.

Check your plugins against the Graveyard →

FAQ

How do I know if a WordPress plugin is no longer supported?

Check the plugin’s page on WordPress.org for three things: a “Last updated” date over two years old, a warning that it hasn’t been tested with recent WordPress versions, and a support forum full of unanswered questions. Any one of these is a caution sign; all three together mean the plugin is effectively abandoned.

Is it safe to keep using an abandoned plugin if it still works?

It’s a risk that grows over time. The plugin’s code no longer receives security patches, so any flaw discovered from now on stays open permanently. If the plugin has a documented vulnerability, remove it immediately. If not, plan to replace it with a maintained alternative rather than waiting for a problem.

Will WordPress warn me if a plugin I use gets removed from the directory?

No. When WordPress.org closes a plugin for security or abandonment, sites already running it receive no notification. The plugin simply stops appearing in update checks. This is why periodically reviewing your plugins against a resource like the Plugin Graveyard matters — your dashboard won’t tell you.

How many WordPress plugins are abandoned?

More than most owners expect. In 2024 alone, WordPress.org removed 1,614 abandoned plugins and themes, per Patchstack. Vimsy’s Plugin Graveyard currently tracks 87 unmaintained plugins with meaningful install bases, 45 of which have known vulnerabilities affecting 3.9 million+ sites. Those counts refresh on the 1st of every month.