Many critical WordPress security flaws never get patched

(Image credit: WordPress)

Plugins for WordPress, or more specifically - free WordPress plugins, are a real primordial soup of flaws and vulnerabilities, many of which allow threat actors to completely take over the target website, and many of which - never get patched.

This is the grim conclusion in a report from Patchstack, a company that provides threat intelligence and security tools for the popular website builder platform.

According to the report, the number of vulnerabilities linked to WordPress grew 150% in 2021 compared to the previous year. Of those vulnerabilities, only 0.58% are in WordPress core, the actual website builder. More than nine in ten (91.38%) were found in free plugins, and 8.62% in commercial plugins.

XSS the most popular flaw

Almost a third (29%) of the critical flaws found in WordPress plugins never get patched. The good news is that the plugins that don’t get patched, are eventually thrown out of the plugin repository. The report said nine plugins never received patches, and were subsequently removed.

Last year, the company discovered five vulnerabilities of critical severity, affecting a total of 55 WordPress themes. One of them abused file upload features, which was a particularly dangerous finding. Among the plugins, Patchstack found 35 critical vulnerabilities, two of which were present in four million websites.

The most popular flaw to be reported, Patchstack further found, was cross-site scripting (XSS), followed by “mixed” cross-site request forgery, SQL injections, and arbitrary file uploads.

> 800,000 WordPress sites still vulnerable to simple takeover attacks

> WordPress update fixes a series of high-severity vulnerabilities

> WordPress plugin vulnerability exposed millions of websites to attack

The average WordPress site has 18 installed components, at least one of which carries in it, a dangerous vulnerability. The report says the number is down, compared to the average 23 plugins installed the year before.

Of all the vulnerable plugins, the most popular targets last year were OptinMonster, PublishPress Capabilities, Booster for WooCommerce plugin, and Image Hover Effects Ultimate plugin.

Almost half (43.2%) of all websites on the internet are powered by WordPress.

Here's our list of the best web hosting providers out there

Via: BleepingComputer

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.