Many critical WordPress security flaws never get patched
Plugins for WordPress, or more specifically – free WordPress plugins, are a real primordial soup of flaws and vulnerabilities, many of which allow threat actors to completely take over the target website, and many of which – never get patched.
This is the grim conclusion in a report from Patchstack, a company that provides threat intelligence and security tools for the popular website builder platform.
According to the report, the number of vulnerabilities linked to WordPress grew 150% in 2021 compared to the previous year. Of those vulnerabilities, only 0.58% are in WordPress core, the actual website builder. More than nine in ten (91.38%) were found in free plugins, and 8.62% in commercial plugins.
XSS the most popular flaw
Almost a third (29%) of the critical flaws found in WordPress plugins never get patched. The good news is that the plugins that don’t get patched, are eventually thrown out of the plugin repository. The report said nine plugins never received patches, and were subsequently removed.
Last year, the company discovered five vulnerabilities of critical severity, affecting a total of 55 WordPress themes. One of them abused file upload features, which was a particularly dangerous finding. Among the plugins, Patchstack found 35 critical vulnerabilities, two of which were present in four million websites.
The most popular flaw to be reported, Patchstack further found, was cross-site scripting (XSS), followed by “mixed” cross-site request forgery, SQL injections, and arbitrary file uploads.
The average WordPress site has 18 installed components, at least one of which carries in it, a dangerous vulnerability. The report says the number is down, compared to the average 23 plugins installed the year before.
Of all the vulnerable plugins, the most popular targets last year were OptinMonster, PublishPress Capabilities, Booster for WooCommerce plugin, and Image Hover Effects Ultimate plugin.
Almost half (43.2%) of all websites on the internet are powered by WordPress.
Via: BleepingComputer
Audio player loading… Plugins for WordPress, or more specifically – free WordPress plugins, are a real primordial soup of flaws and vulnerabilities, many of which allow threat actors to completely take over the target website, and many of which – never get patched. This is the grim conclusion in a…
