What is a Zero-Day Exploit?

A zero-day exploit is attack code for a security vulnerability that the software vendor does not know about yet. The name is bookkeeping, not poetry: the developers have had zero days to build a fix, so at the moment of attack no patch and often no detection signature exists. Three related terms are worth keeping apart. The zero-day vulnerability is the unknown flaw itself, the zero-day exploit is the working attack code for it, and a zero-day attack is that code being used against real targets. Genuine zero-days are rare and expensive: Google Threat Intelligence Group counted 75 zero-day vulnerabilities exploited in the wild in 2024, down from 98 the year before, most of them burned in targeted attacks by state-sponsored groups and commercial spyware vendors. For a normal website the statistically dominant danger is not the zero-day at all, but the n-day: the window after a patch is released in which attackers mass-exploit everyone who has not updated yet.

What does zero-day mean? Vulnerability, exploit and attack

The term gets thrown around loosely, so precision helps:

• Zero-day vulnerability: a security flaw that exists in shipped software but is unknown to the vendor. It may sit undiscovered for years, and studies of exploited zero-days regularly find flaws that were in the code for a long time.
• Zero-day exploit: functioning code that turns the flaw into an actual capability, such as remote code execution or privilege escalation. Writing a reliable exploit is often far harder than finding the bug.
• Zero-day attack: the exploit used against real targets while the vendor is still in the dark.

The zero counts the days the defender has had to respond. The moment the vendor learns of the flaw, the clock starts running, and once a patch ships the same exploit degrades into an n-day: still dangerous, but only against those who have not updated.

How does a zero-day attack work? The lifecycle of a vulnerability

1. The flaw is born: a bug lands in production code, unnoticed by everyone.
2. Someone finds it: and here the paths fork. A security researcher reports it to the vendor, ideally through a coordinated disclosure process or bug bounty program. A criminal or state actor keeps it secret and weaponises it.
3. Exploitation in the wild: in the bad branch, the exploit is used quietly against selected targets. This phase can last months, and it typically ends only when defenders spot the anomaly.
4. Disclosure and patch: the vendor develops a fix and publishes an advisory, usually with a CVE ID.
5. The n-day phase: now the flaw is public, the patch can be reverse engineered, and exploitation flips from targeted to industrial. Attackers scan the entire internet for unpatched systems, and the time between patch release and mass exploitation has shrunk to days, sometimes hours.

That last step surprises people: publication of a patch temporarily makes the situation more dangerous, not less, for everyone who does not apply it. The patch is the map to the vulnerability.

Zero-day vs n-day: which one should you actually fear?

Honest risk assessment for a website owner: a true zero-day used against you is unlikely unless you are a government, a large enterprise, a journalist or otherwise a specifically valuable target. Zero-days cost real money and lose value with every use, so attackers spend them carefully. What hits ordinary websites every single day is the n-day. The vulnerability is public, exploit code is on GitHub, and bots scan for the affected software version around the clock. The defence against n-days is unglamorous and extremely effective: update fast. A site that applies security updates within a day is immune to the phase in which the vast majority of real-world compromises happen.

Famous zero-day attacks

• Stuxnet (2010): the sabotage worm against the Iranian nuclear program used four Windows zero-days in a single operation, unheard of at the time, and made the term mainstream.
• Sony Pictures and the spyware era: commercial vendors like NSO Group industrialised zero-day chains, with FORCEDENTRY (CVE-2021-30860) infecting fully patched iPhones through a zero-click iMessage exploit.
• MOVEit Transfer (2023): the Cl0p ransomware group exploited an SQL injection zero-day (CVE-2023-34362) in a managed file transfer product and stole data from well over 2,000 organisations in one campaign, one of the largest supply-chain-style breaches on record.
• Enterprise edge devices (2023 to 2025): the recent trend is zero-days in the security infrastructure itself, VPN gateways, firewalls and file transfer appliances, because one exploited appliance opens hundreds of corporate networks.

How many zero-days are exploited each year?

The best public numbers come from Google Threat Intelligence Group, which tracks in-the-wild zero-day exploitation across the industry: 75 exploited zero-days in 2024, 98 in 2023, 63 in 2022. Two trends inside those numbers matter. First, an increasing share targets enterprise products, especially security and networking appliances, rather than end-user software. Second, a substantial portion traces back to commercial surveillance vendors selling intrusion capabilities to governments. Browsers and mobile operating systems remain popular targets, but they have also become dramatically harder to exploit, which is exactly why prices keep climbing.

The zero-day market: bug bounties and exploit brokers

What happens after discovery depends on who found the flaw, and there is a market for each answer. In the white market, researchers report to vendors for bug bounties, with programs like the Zero Day Initiative and events like Pwn2Own paying five and six figure rewards, and Google Project Zero enforcing its well-known 90-day disclosure deadline on vendors. In the grey market, brokers buy exploits and resell them to government customers, with published price lists reaching seven figures for zero-click smartphone chains. And in the black market, the same class of goods changes hands between criminals. The economics explain the defence: every layer of exploit mitigation raises the development cost of a working chain, and every fast patch cycle shortens the shelf life of the product.

Zero-day exploits in WordPress

WordPress core has not suffered a meaningful zero-day compromise wave in years, and its security team is quick. The plugin ecosystem is another story, and it has produced textbook cases. In September 2020, attackers exploited a file upload flaw in WP File Manager (CVE-2020-25213) as a zero-day, against a plugin active on roughly 700,000 sites, with hundreds of thousands of attack attempts recorded before most sites could update. In 2021, the Fancy Product Designer plugin was attacked through CVE-2021-24370 while no patch existed. The pattern is consistent: attackers watch popular plugins, and a flaw in one of them instantly scales to every site running it. Your practical takeaway is blunt: every installed plugin is attack surface, and a plugin you do not run cannot hurt you with its zero-day.

How can I protect my website against zero-day exploits?

You cannot patch the unknown, so the goal shifts from prevention to limiting blast radius and reacting fast. The measures that actually move the needle:

• Shrink the attack surface: uninstall plugins and themes you do not use. Deactivated is not enough, delete them.
• Prefer well-maintained plugins: an active developer means the eventual patch arrives in hours instead of weeks, or ever.
• Use a web application firewall: WAF vendors ship virtual patches that block exploitation patterns before the official fix exists, which is the closest thing to a real zero-day defence a site owner has.
• Enforce least privilege: fewer admin accounts, two-factor authentication, no shared logins. An exploit that lands in a low-privilege context does less damage.
• Harden the platform: DISALLOW_FILE_EDIT, correct file permissions, no debug output in production. Hardening does not stop the exploit, it starves the post-exploitation.
• Keep offsite backups and monitor file integrity: assume compromise is possible and make recovery boring.
• Update fast when patches appear: the n-day window is where you win or lose, and it is entirely under your control.

How does InspectWP help against zero-days?

InspectWP cannot see an undisclosed vulnerability, and any tool claiming otherwise is selling something. What it does cover is everything around the zero-day: it inventories the plugins and themes a site actually runs, flags components with known vulnerabilities the moment they are published, and checks the hardening measures that limit what an exploit can do, from security headers to exposed sensitive files. That inventory is exactly what you need on the day a plugin zero-day hits the news, because the first question is always the same: do we run this anywhere? With scheduled reports across your projects, you answer it in seconds instead of grepping through a dozen wp-admin dashboards.