Patchstack analysts have released a report on security and critical vulnerabilities in WordPress in 2021.
Unfortunately, the picture turned out to be depressing, for example, it turned out that 29% of critical errors in WordPress plugins did not receive patches at all. In addition, the number of reported vulnerabilities has increased by 150% over the past year.
The researchers write that all this is alarming, since WordPress is the most popular CMS in the world, which is used by 43.2% of all sites in the world.
Of all the bugs that experts reported in 2021, only 0.58% were related to the WordPress core, and the rest were related to different themes and plugins for the platform from different developers. At the same time, 91.38% of vulnerabilities were found in free plugins, while paid solutions for WordPress accounted for only 8.62% of the total number of problems, and this says a lot about the procedures for checking and testing code.
Patchstack experts have identified five critical vulnerabilities affecting 55 WordPress themes, with the most serious of these vulnerabilities related to file upload abuse.
As for plugins, 35 critical vulnerabilities were found in them, two of which affected 4,000,000 sites. Although plugin developers mostly fixed these vulnerabilities, nine plugins never received patches and were eventually removed from marketplaces altogether.
PatchStack also notes that XSS vulnerabilities top the list of the most common flaws in WordPress in 2021, followed by “mixed” vulnerabilities, CSRF, SQL injection and arbitrary file uploads.
Overall, in 2021, about 42% of WordPress sites, on average, contained at least one vulnerable component out of 18 installed. Although this number is less than the 23 plugins installed on average on websites in 2020, the problem is now complicated by the fact that 6 out of 18 are already out of date.
The most vulnerable outdated plugins in 2021 are OptinMonster, PublishPress Capabilities, Booster for WooCommerce, and Image Hover Effects Ultimate.
Let me remind you that we also wrote that Hackers create scam e-commerce sites over hacked WordPress sites, and also that KashmirBlack botnet is behind attacks on popular CMS including WordPress, Joomla and Drupal.
