Many critical WordPress security flaws never get patched

By Scott Marlette Last updated Mar 10, 2022

Plugins for WordPress, or more specifically – free WordPress plugins, are a real primordial soup of flaws and vulnerabilities, many of which allow threat actors to completely take over the target website, and many of which – never get patched.

This is the grim conclusion in a report from Patchstack, a company that provides threat intelligence and security tools for the popular website builder platform.

According to the report, the number of vulnerabilities linked to WordPress grew 150% in 2021 compared to the previous year. Of those vulnerabilities, only 0.58% are in WordPress core, the actual website builder. More than nine in ten (91.38%) were found in free plugins, and 8.62% in commercial plugins.

XSS the most popular flaw

Almost a third (29%) of the critical flaws found in WordPress plugins never get patched. The good news is that the plugins that don’t get patched, are eventually thrown out of the plugin repository. The report said nine plugins never received patches, and were subsequently removed.

Last year, the company discovered five vulnerabilities of critical severity, affecting a total of 55 WordPress themes. One of them abused file upload features, which was a particularly dangerous finding. Among the plugins, Patchstack found 35 critical vulnerabilities, two of which were present in four million websites.

The most popular flaw to be reported, Patchstack further found, was cross-site scripting (XSS), followed by “mixed” cross-site request forgery, SQL injections, and arbitrary file uploads.

The average WordPress site has 18 installed components, at least one of which carries in it, a dangerous vulnerability. The report says the number is down, compared to the average 23 plugins installed the year before.

Of all the vulnerable plugins, the most popular targets last year were OptinMonster, PublishPress Capabilities, Booster for WooCommerce plugin, and Image Hover Effects Ultimate plugin.

Almost half (43.2%) of all websites on the internet are powered by WordPress.

Via: BleepingComputer

For all the latest Technology News Click Here

For the latest news and updates, follow us on Google News.

Read original article here

Denial of responsibility! TechNewsBoy.com is an automatic aggregator around the global media. All the content are available free on Internet. We have just arranged it in one platform for educational purpose only. In each content, the hyperlink to the primary source is specified. All trademarks belong to their rightful owners, all materials to their authors. If you are the owner of the content and do not want us to publish your materials on our website, please contact us by email – [email protected]. The content will be deleted within 24 hours.