Pirated themes and plugins are the most widespread threat to WordPress sites

Pirated (aka nulled) themes and plugins were the most common source of malware infections on WordPress sites in 2020, according to Wordfence, a provider of website application firewall (WAF) solutions for WordPress sites.

The security firm said its malware scanner detected more than 70 million malicious files on more than 1.2 million WordPress sites in 2020.

"Overall, the Wordfence scanner found malware originating from a nulled plugin or theme on 206,000 sites, accounting for over 17% of all infected sites," the company said on Wednesday.

Of these 206,000 sites, 154,928 were infected with a version of the WP-VCD malware, a WordPress malware strain known for its use of pirated/nulled themes for distribution.

Wordfence said this particular malware operation was so successful last year that it accounted for 13% of all infected sites in 2020.