No. A child theme protects your customisations from being overwritten when the parent theme updates. It does not isolate you from flaws in the parent, because the parent's code still loads and runs. Keep both themes current and review the files your child theme overrides.
What a child theme is for
A child theme extends a parent theme. It inherits the design and functions and lets you change them without editing the parent. The WordPress documentation says you can receive parent updates without losing your changes, which is the whole point.
That is a maintenance benefit, not a security boundary. The two themes run together in the same process with the same privileges.
Where the security risk sits
| Part | Who maintains it | Risk |
|---|---|---|
| Parent theme code | The theme author | Flaws here affect your site |
| Child functions.php | You | Loads in addition to the parent, with its own bugs |
| Overridden templates | You | Copies of old parent code can keep an old flaw |
| Block theme customisations | Stored in the database | Not visible as files |
The overridden template row is the subtle one. When your child theme includes a copy of a parent template file, WordPress uses your copy. If the parent later fixes a flaw in that template, your copy keeps the old behaviour until you merge the fix.
The documentation also states that functions.php in the child does not replace the parent's file: both load, with the child first. Copying parent functions into the child causes duplicate name errors, but it also copies any flaws in them.
What to do
- Update the parent theme promptly, since that is where fixes arrive.
- List the template files your child theme overrides and compare them with the parent after each parent update.
- Keep overrides few. The fewer files you copy, the fewer stale copies you carry.
- Review the child theme's functions.php like any other custom code.
- Delete themes you do not use. The hardening guide recommends removing unused plugins, and the same logic applies to themes.
When the parent is abandoned
If the parent theme stops receiving updates, a child theme only delays the problem. The documentation notes that a forked, standalone theme may suit large projects better. Plan a move to a maintained theme or take ownership of the code, and treat it like any other abandoned dependency.
Keep a record
Record for each site which parent theme and version, which child theme, and which files are overridden. A short note saves an hour during an incident. If you track a theme's build dependencies in a repository, Safeguard can scan a repository for dependency manifests and produce an SBOM, and there is a free scan at gold.safeguard.sh/scan.
Quick check
Do I need to update the parent if I use a child theme?
Yes. The parent is where fixes arrive, and its code runs on your site.
Can a child theme hold an old vulnerability?
Yes, if it overrides a parent template and the parent later fixes that file. Compare overrides after parent updates.
Sources
Last reviewed: 19 October 2026.
