2024 WordPress Vulnerability Report Shows Errors Sites Keep Making

WordPress information scanner WPScan’s 2024 WordPress vulnerability study calls attraction to WordPress vulnerability trends and suggests nan kinds of things website publishers (and SEOs) should beryllium looking retired for.

Some of nan cardinal findings from nan study were that conscionable complete 20% of vulnerabilities were rated arsenic precocious aliases captious level threats, pinch mean severity threats, astatine 67% of reported vulnerabilities, making up nan majority. Many respect mean level vulnerabilities arsenic if they are low-level threats and that’s a correction because they’re not debased level and should beryllium regarded arsenic deserving attention.

The study does not blasted users for nan malware and website vulnerabilities. But mistakes made by publishers tin amplify nan occurrence of hackers exploiting vulnerabilities.

The WPScan study advised:

“While severity doesn’t construe straight to nan consequence of exploitation, it’s an important line for website owners to make an knowledgeable determination astir erstwhile to disable aliases update nan extension.”

WordPress Vulnerability Severity Distribution

Critical level vulnerabilities, nan highest level of threat, represented only 2.38% of vulnerabilities, which is fundamentally bully news for WordPress publishers. Yet arsenic mentioned earlier, erstwhile mixed pinch nan percentages of precocious level threats (17.68%) nan number aliases concerning vulnerabilities rises to almost 20%.

Here are nan percentages by severity ratings:

• Critical 2.38%
• Low 12.83%
• High 17.68%
• Medium 67.12%

Authenticated Versus Unauthenticated

Authenticated vulnerabilities are those that require an attacker to first attain personification credentials and their accompanying support levels successful bid to utilization a peculiar vulnerability. Exploits that require subscriber-level authentication are nan astir exploitable of nan authenticated exploits and those that require administrator level entree coming nan slightest consequence (although not ever a debased consequence for a assortment of reasons).

Unauthenticated attacks are mostly nan easiest to utilization because anyone tin motorboat an onslaught without having to first get a personification credential.

The WPScan vulnerability study recovered that astir 22% of reported vulnerabilities required subscriber level aliases nary authentication astatine all, representing nan astir exploitable vulnerabilities. On nan different extremity of nan standard of nan exploitability are vulnerabilities requiring admin support levels representing a full of 30.71% of reported vulnerabilities.

Nulled Software And Weak Passwords

Weak passwords and nulled plugins were 2 communal reasons for malware recovered done nan Jetpack Scan. Nulled package are pirated plugins that had their expertise to validate if they were paid for blocked. These plugins tended to person backdoors that enabled infections pinch malware. Weak passwords tin beryllium guessed done brute-force attacks.

The WPScan study explains:

“Authentication bypass attacks could impact a assortment of techniques, specified arsenic exploiting weaknesses successful anemic passwords, guessing credentials, utilizing brute unit attacks to conjecture passwords, utilizing societal engineering strategies specified arsenic phishing aliases pretexting, utilizing privilege escalation techniques specified arsenic exploiting known vulnerabilities successful package and hardware devices aliases trying default relationship logins.”

Permission Levels Required For Exploits

Vulnerabilities requiring administrator level credentials represented nan highest percent of exploits, followed by Cross Site Request Forgery (CSRF) pinch 24.74% of vulnerabilities. This is absorbing because CSRF is an onslaught that uses societal engineering to get a unfortunate to click a nexus from which nan user’s support levels are acquired. This is simply a correction that WordPress publishers should beryllium alert of because each it takes is for an admin level personification to travel a nexus which past enables nan hacker to presume admin level privileges to nan WordPress website.

The pursuing is nan percentages of exploits ordered by roles basal to motorboat an attack.

Ascending Order Of User Roles For Vulnerabilities

• Author 2.19%
• Subscriber 10.4%
• Unauthenticated 12.35%
• Contributor 19.62%
• CSRF 24.74%
• Admin 30.71%

Most Common Vulnerability Types Requiring Minimal Authentication

Broken Access Control successful nan discourse of WordPress refers to a information nonaccomplishment that tin let an attacker without basal support credentials to summation entree to higher credential permissions.

In nan conception of nan study that looks astatine nan occurrences and vulnerabilities underlying unauthenticated aliases subscriber level vulnerabilities reported (Occurrence vs Vulnerability connected Unauthenticated aliases Subscriber+ reports), WPScan breaks down nan percentages for each vulnerability type that is astir communal for exploits that are nan easiest to motorboat (because they require minimal to nary personification credential authentication).

The WPScan threat study noted that Broken Access Control represents a whopping 84.99% followed by SQL injection (20.64%).

The Open Worldwide Application Security Project (OWASP) defines Broken Access Control as:

“Access control, sometimes called authorization, is really a web exertion grants entree to contented and functions to immoderate users and not others. These checks are performed aft authentication, and govern what ‘authorized’ users are allowed to do.

Access power sounds for illustration a elemental problem but is insidiously difficult to instrumentality correctly. A web application’s entree power exemplary is intimately tied to nan contented and functions that nan tract provides. In addition, nan users whitethorn autumn into a number of groups aliases roles pinch different abilities aliases privileges.”

SQL injection, astatine 20.64% represents nan 2nd astir prevalent type of vulnerability, which WPScan referred to arsenic some “high severity and risk” successful nan discourse of vulnerabilities requiring minimal authentication levels because attackers tin entree and/or tamper pinch nan database which is nan bosom of each WordPress website.

These are nan percentages:

• Broken Access Control 84.99%
• SQL Injection 20.64%
• Cross-Site Scripting 9.4%
• Unauthenticated Arbitrary File Upload 5.28%
• Sensitive Data Disclosure 4.59%
• Insecure Direct Object Reference (IDOR) 3.67%
• Remote Code Execution 2.52%
• Other 14.45%

Vulnerabilities In The WordPress Core Itself

The overwhelming mostly of vulnerability issues were reported successful third-party plugins and themes. However, location were successful 2023 a full of 13 vulnerabilities reported successful nan WordPress halfway itself. Out of nan thirteen vulnerabilities only 1 of them was rated arsenic a precocious severity threat, which is nan 2nd highest level, pinch Critical being nan highest level vulnerability threat, a standing scoring strategy maintained by nan Common Vulnerability Scoring System (CVSS).

The WordPress halfway level itself is held to nan highest standards and benefits from a worldwide organization that is vigilant successful discovering and patching vulnerabilities.

Website Security Should Be Considered As Technical SEO

Site audits don’t usually screen website information but successful my sentiment each responsible audit should astatine slightest talk astir information headers. As I’ve been saying for years, website information quickly becomes an SEO rumor erstwhile a website’s ranking commencement disappearing from nan hunt motor results pages (SERPs) owed to being compromised by a vulnerability. That’s why it’s captious to beryllium proactive astir website security.

According to nan WPScan report, nan main constituent of introduction for hacked websites were leaked credentials and anemic passwords. Ensuring beardown password standards positive two-factor authentication is an important portion of each website’s information stance.

Using information headers is different measurement to thief protect against Cross-Site Scripting and different kinds of vulnerabilities.

Lastly, a WordPress firewall and website hardening are besides useful proactive approaches to website security. I erstwhile added a forum to a marque caller website I created and it was instantly nether onslaught wrong minutes. Believe it aliases not, virtually each website worldwide is nether onslaught 24 hours a time by bots scanning for vulnerabilities.

Read nan WPScan Report:

WPScan 2024 Website Threat Report

Featured Image by Shutterstock/Ljupco Smokovski