Sarah Gooding
Patchstack has published its State of WordPress Security whitepaper with a summary of threats to the WordPress ecosystem recorded in 2021. The whitepaper aggregates data from multiple sources, including the Patchstack Vulnerability Database, the Patchstack Alliance (the company’s bug bounty platform), and publicy reported CVEs from other sources.
In 2021, Patchstack recorded nearly 1,500 vulnerabilities, a 150% increase as compared to 2020, which recorded ~600. Patchstack found that the majority of these come from the WordPress.org directory:
The WordPress.org repository leads the way as the primary source for WordPress plugins and themes. Vulnerabilities in these components represented 91.79% of vulnerabilities added to the Patchstack database.
The remaining 8.21% of the reported vulnerabilities in 2021 were reported in premium or paid versions of the WordPress plugins or themes that are sold through other marketplaces like Envato, ThemeForest, Code Canyon, or made available for direct download only.
WordPress core shipped four security releases, and only one included a patch for a critical vulnerability. This particular vulnerability was not in WordPress itself but rather in one of its bundled open source libraries, the PHPMailer library.
Patchstack estimates that 99.31% of all security bugs from 2021 were in components – WordPress plugins and themes. Themes had the most critical vulnerabilities, logging 55 this year. Patchstack found that 12.4% of vulnerabilities reported in themes had a critical CVSS score of 9.0-10.0. Arbitrary file upload vulnerabilities were the most common.
Plugins had a total of 35 critical security issues. This is fewer vulnerabilities compared to themes, but 29% of these received no public patch.
“The most surprising finding was really also the most unfortunate truth,” Patchstack Security Advocate Robert Rowley said. “I was not expecting to see so many plugins with critical vulnerabilities in them not receive patches.
“Some of those vulnerabilities required no authentication to perform, and have publicly available proof of concepts (exploit code) made widely available online. It is probably already too late for the site owners who did not get a notice that their websites were vulnerable.”
Patchstack surveyed 109 WordPress site owners and found that 28% of respondents had zero budget for security, 27% budgeted $1-3/month, and just 7% budget ~$50/month. Agencies were more likely to allocate monthly costs to security than individual site owners.
Conversely, results from these same respondents showed$613 as the average cost of malware removal. Post-compromise cleanup prices reported ranged from $50 – $4,800.
Rowley sees the significant increase in security vulnerabilities found in 2021 as evidence of more engaged security professionals, not a sign of the WordPress ecosystem becoming less secure.
“Most likely this is due to more security bugs being reported (more vulnerable code being found, because more people are looking),” Rowley said. “Patchstack runs a bug bounty program which pays security researchers for the bugs they report in the WordPress ecosystem, which incentives security researchers (and even developers familiar with WordPress) to look for more security bugs.”
Overall, Patchstack’s findings this year show that WordPress core is very secure and the vast majority of vulnerabilities are found in themes and plugins. Users should monitor their extensions and periodically check to see if they have been abandoned, as not all vulnerable software is guaranteed to get patched. Check out the full security whitepaper for more details on the types of vulnerabilities most commonly found in 2021.
Keep your passwords long like 25 characters combination of upper and lowercase along with symbols.
Never use same password twice.
Use some kind of 2FA.
Password advice above for login username, mysql database, hosting account and domain registrar account if at different company than hosting account.
Keep up to date theme/core/plugins, don’t do the whole wait a bit.
Make sure your theme and plugins are no older than 6 months since the last update. I used to say 12 months. Maybe 3?
If your hosting/domains company/-ies have 2FA, use it.
If you use a third-party company/website, like managewp or jetpack, etc…same applies, specially 2FA.
Go through the settings for your security plugin.
So many people think that all you have to do is install a plugin, activate it and that is it.
Do weekly backups, daily if you are extremely popular.
You do not need a million dollars security budget. Get off your rear end, and do something. There is more security either than install+activate.
Hacked sites, 99% is because of a lazy human.
What he said. 👍
Disable PHP execution in uploads folders as well. This is usually just a toggle on the webhost dashboard.
Your email address will not be published.
document.getElementById( “ak_js_1” ).setAttribute( “value”, ( new Date() ).getTime() );
This site uses Akismet to reduce spam. Learn how your comment data is processed.
Enter your email address to subscribe to this blog and receive notifications of new posts by email.
WordPress Tavern is a website about all things WordPress. We cover news and events, write plugin and theme reviews, and talk about key issues within the WordPress ecosystem…
© All Rights Reserved. Powered by WordPress, hosted by Pressable
