In today’s article, we will go through the most common WordPress vulnerabilities and how you can avoid or fix them, fix them. It is a known fact that more than 40 percent of all websites in the world are based on WordPress CMS. Although it is a very secure CMS by itself, the ability for anyone to develop their own theme or plugin makes WordPress more vulnerable.
1. WordPress core files out of date
As WordPress is the most popular CMS in the world. One of the reasons for its popularity is the fact that WordPress developers roll out updates every three months on average. This means that they worked hard on removing security vulnerabilities and improvements and bug fixes. So this means that WordPress is a platform that’s constantly being updated and developed.
If your WordPress files are not up to date then you are vulnerable to attacks. As we mentioned, WordPress developers are trying to correct all the vulnerabilities of the previous version. According to the estimates of some agencies dealing with online security, more than 50 percent of attacked WordPress sites did not have the latest version of WordPress installed.
There are two ways to keep your WordPress files up to date. The first is to turn on automatic update in your website’s admin dashboard. When a new version of WordPress is available, your website will be automatically updated – it’s as simple as that. However, we do not recommend this method because a new WordPress version or update may be incompatible with your active theme or one or more of the plugins you’ve installed. This could put your website in an inoperable state. That’s why it’s best to wait for theme and plugin developers to roll out updates for their products that will be compatible with the latest WordPress version, and then do the update manually.
Be sure to always make a backup copy of WordPress files and database before updating your website.
2. Out of date themes and plugins
According to the estimates of the leading security services, out of a hundred attacks more than 95 were realized due to security flaws in the theme or plugin, and only a few of them were realized because of flaws in the WordPress core files. This is why you must always keep your themes and plugins up to date.
Theme and plugins developers try to fix vulnerabilities from the previous version, so they should roll out new updates often, at least several times a year. Of course, there are themes and plugins that never release new updates, we advise you not to install such products at all.
After a WordPress update is available, check after a few days whether your theme or plugin developer has rolled out an update for their product. If it is, and if the developer guarantees that the product has been tested on your WordPress version, be sure to install the update.
3. Unauthorized access to WP dashboard
Although WordPress is almost a perfect CMS, unfortunately it does not have much protection implemented to prevent unauthorized access to your WordPress admin dashboard.
There are two most common ways for someone to gain access to your WordPress dashboard. The first way is to have the credentials of one of your admins, no matter how they got them. Another way is to use a brute-force attack and try to guess the username and password using large dictionaries that contain many of the most common passwords.
Both types of these attacks can be prevented using WordPress plugins. To prevent someone from using someone else’s login credentials, install a two-factor authentication plugin. One of the best plugins on the market for this purpose is the Wordfence Security plugin which also has (2FA) in its login security section.
This plugin works in such a way that after the user enters his login and password, he receives a code on his phone or e-mail that he must use to confirm that he has signed in. After entering the code the sign in process will be successful. This method is very effective because if someone knows your login credentials, they must also have physical access to your phone to log in.
To prevent someone from gaining access using a brute-force attack, use the “limit login attempt” plugin.
One of the best plugins for this purpose is the Wordfence Security plugin that we mentioned a few lines above. This type of protection works by defining how many times someone can try to log in. After unsuccessful login attempts as many times as you defined, the login form will be locked for a certain period. In this way you have ensured that no one can try to log in several hundred times a minute and thus guess your credentials.
4. SQL injections
This is one of the biggest WordPress vulnerabilities and is often used to modify the structure of WordPress databases. It is known that all records within WordPress are placed in a SQL database. Attackers can execute code on your server that will help him to gain access to your database, and then change and modify its content.
The most common way this type of attack is carried out is through any submission form, such as a contact form, payment form and many others. In any field on the contact form an attacker can enter malicious code that will be executed on your server. That way the attacker has full access and the hacker can do anything on your database.
The best way to protect website from this type of attack is to disable the use of special characters in the contact form fields. Every SQL query contains special characters, if an attacker writes it after you have disabled the use of special characters, absolutely nothing will happen.
It is advisable to change the database prefix from the default “wp_” to a hidden one, which only you know. Attackers use the database prefix to locate your files and carry out an attack more easily.
Since SQL attacks are mostly done by bots, it would be best to implement a captcha or some other similar kind of verification to prevent them from completing the task.
There are also numerous plugins that will protect your website from SQL injection attacks, and one of the best on the market is the Wordfence or the All-In-One Security plugins.
5. Malware
Just like any other CMS, WordPress is also vulnerable to malware attacks. This attack is executed by injecting malicious code inside your files. Once the code is executed, it does the tasks the attacker intended. This is a very dangerous attack because it very often goes unnoticed for a long period of time. Attackers usually send SPAM messages from infected websites, spread bad links and try to get sensitive information such as credit card numbers, social security information and many others.
To prevent this type of attack you must keep all your products, including the WordPress core files, up to date. Outdated versions of software usually contain some vulnerabilities that have been fixed in newer versions. If your theme or plugin has vulnerabilities and you haven’t updated them, there is a big chance that you will become the target of an attack.
Most often websites that use nulled themes and plugins are attacked. Malicious code is always written into these products. Although you think you got some commercial product for free, you are actually being attacked without knowing it. If Google notices that your website spreads SPAM messages or has malicious code, you will be completely deleted from the Google index, and your website will be banned. This can irreversibly destroy your reputation and business.
6. Using an old PHP version
PHP is the programming language used to build and maintain the WordPress CMS. Just like all other software, if PHP is out of date it is a security issue due to known vulnerabilities and susceptibility to attacks.
To prevent attacks on your website caused by an older version of the PHP programming language, the only solution is to update PHP to the latest and secure version.
There are two ways you can do a PHP update. If you use one of the excellent hosting providers that offer cPanel or a similar administration tool within their service, you can change the PHP version yourself to one of the newer ones. It only takes a few clicks to complete that task.
Another way is to do the PHP update yourself if you have full access to your hosting server. This task consists of many steps and we do not recommend it unless you are an experienced WordPress user. There are many things that can go wrong. If you still decide to update PHP yourself, then be sure to make a backup copy of your website before starting work.
Final thoughts on the most common WordPress vulnerabilities
WordPress is the best and most used CMS today. However, in order to keep it completely safe and functional, it is necessary to do some important tasks. If you intend to create your own WordPress website on which your business will be based, then you must place security as a top priority. In this article we explained what are the most common WordPress vulnerabilities and how to fix them so that your website remains safe and functional.