Most infected WordPress sites I see did not get hacked because “WordPress is insecure.” They got hacked because something on the site stopped receiving updates, or because a nulled plugin arrived already tampered with.
Outdated plugins are unpatched doors
Plugin authors publish updates for a reason. A vulnerability disclosed last month is public knowledge. Automated scanners try those holes on any site they can find. An otherwise healthy theme and a strong password will not help if an abandoned slider plugin still accepts unauthenticated input.
Nulled plugins add a second problem
A nulled plugin is a paid plugin distributed without a license, often with the update checker removed or altered. The person who packed it can add a backdoor, a spam injector, or a hidden admin user. You also lose official updates, so the two risks stack: malware on day one, and no patch later.
How this usually shows up
The site may run for months. Then search engines list spam pages, checkout redirects on mobile, or PHP runs a file inside uploads that nobody uploaded from the media library. Cleanup is possible, but if the nulled plugin stays installed, reinfection is likely.
What to do instead
Prefer plugins that are still maintained, have a clear changelog, and match a real need. If a premium feature matters, buy it from the author. If it does not matter enough to buy, do not install a pirated copy to “try it.” Remove unused plugins rather than leaving them deactivated; deactivated code can still be reachable if a file remains on disk.
After a cleanup I look at the plugin list with the same skepticism I use on malware signatures. For hands-on cleanup, see hacked WordPress and malware removal.