WordPress Plugins Expose Sites to Increased Risk, Report Finds

WordPress is one of the most popular and widely deployed content management system technologies on the web, though many WordPress sites are at risk from vulnerable plugins. That’s one of the key findings from the SiteLock Website Security Insider Q2 2017 report, which is based on an analysis from a sample size of more than 6 million websites. SiteLock found that 44 percent of plugins in the WordPress repository have not been updated in over a year. Correspondingly, SiteLock also found a correlation between the number of installed plugins on a WordPress site and the chances of that site being compromised. In this slide show, eWEEK looks at some of the highlights from the SiteLock Website Security Insider Q2 2017 report.

WordPress is one of the most popular and widely deployed content management system technologies on the web, though many WordPress sites are at risk from vulnerable plugins. That’s one of the key findings from the SiteLock Website Security Insider Q2 2017 report, which is based on an analysis from a sample size of more than 6 million websites. SiteLock found that 44 percent of plugins in the WordPress repository have not been updated in over a year. Correspondingly, SiteLock also found a correlation between the number of installed plugins on a WordPress site and the chances of that site being compromised. In this slide show, eWEEK looks at some of the highlights from the SiteLock Website Security Insider Q2 2017 report.

Across its sample size of over 6 million websites, SiteLock reported that in the second quarter of 2017, websites experienced an average of 63 attacks per day. The majority of those attacks are malicious bot access attempts.

Comparing the number of infected files by malware type, SiteLock found that spam represented 62 percent of total malware files across the entire sample group.

While popular search engines like Google regularly identify potentially malicious sites, SiteLock’s analysis found that 77 percent of infected websites had no search engine warnings to visitors.

SiteLock also conducted a survey of 20,000 website owners to find out who they perceived should be responsible for website security. Forty percent of surveyed website owners believe their hosting provider should be responsible for the security of their site.

The core WordPress content management system is regularly updated with security patches via an automated system. However, SiteLock found that 69 percent of infected WordPress websites were running the latest security patches for the WordPress core at the time of compromise. The implication is that noncore elements of WordPress, including themes and plugins, are largely the cause of infections.

Among the security challenges with WordPress plugins is the simple fact that there are many plugins that are not regularly updated. SiteLock reported that 44 percent of the plugins in the WordPress plugins repository have not been updated in more than a year.

SiteLock’s analysis found a correlation between the number of plugins installed on a WordPress site and the risk of a site to compromise. WordPress websites with six to 10 plugins are approximately two times more likely to be compromised than the average website. WordPress websites that have 11 to 20 plugins are nearly 2.5 times more likely to be compromised than the average website, according to SiteLock.