Pirated themes and plugins are the most widespread threat to WordPress sites

"Overall, the Wordfence scanner found malware originating from a nulled plugin or theme on 206,000 sites, accounting for over 17% of all infected sites," Wordfence said on Wednesday.