How to protect your WordPress site from plugin vulnerabilities

If you regularly follow WordPress newsletters or cybersecurity updates, you’ve probably noticed a familiar pattern: almost every week, there’s a new report about a WordPress plugin vulnerability. Why is this happening so often?

One reason for these vulnerabilities is that plugin development in the WordPress ecosystem is vast and involves many developers who aren’t directly affiliated with WordPress itself. While WordPress provides clear guidelines to ensure security, the sheer scale and complexity of the ecosystem — with thousands of plugins and themes working together — can sometimes make it difficult to catch every potential flaw.

What’s more, developers sometimes rush to release updates or new features, and even well-meaning coders might unintentionally overlook security concerns, allowing hackers to exploit vulnerabilities.

Once a vulnerability is discovered, hackers can use various technical exploits to compromise your site. Common methods include cross-site scripting (XSS), SQL injection, and cross-site request forgery (CSRF). These exploits allow hackers to perform a range of malicious activities, such as:

• Redirecting visitors to malicious sites.
• Injecting spam ads and unwanted content into your site.
• Installing malware (e.g., infecting files like wp-feed.php) to execute further attacks.
• Creating rogue admin accounts to take control of your site.
• Using your server to launch DDoS attacks or send spam emails.

These attacks can cripple your site’s performance, bring down your SEO rankings, and, most importantly, damage your business, revenue, and reputation.

However, it’s important to note that plugin vulnerabilities themselves are not the only problem. A major reason these attacks succeed is that many WordPress users fail to update their plugins. This article explores why these vulnerabilities are on the rise and what you can do to protect your site.

The real cause of most WordPress hacks

When WordPress sites get hacked, we are quick to blame either the hosting provider or the plugins that supposedly opened the door to attackers. It’s true that plugin vulnerabilities play a significant role. According to SolidWP’s 2022 WordPress vulnerability report, 93% of WordPress vulnerabilities came from plugins. However, the underlying issue is often user negligence.

Most hacks occur not because the platform or plugins are inherently insecure, but because users fail to either update their plugins in a timely manner or because some plugins are abandoned.

To better understand how these vulnerabilities expose your site, let’s take a closer look at the two major factors:

Outdated plugins

When a security flaw is discovered in a plugin, the developers are notified and typically work quickly to create a patch. Once the patch is ready, it’s released as an update, and a vulnerability disclosure is sent out, alerting users to apply the update.

However, there’s often a delay between the disclosure and when users actually update their plugins. Hackers capitalize on this gap, scanning the web for sites that haven’t yet patched the vulnerability.

A striking example of this was the File Manager plugin vulnerability discovered in September 2020, which affected over 600,000 WordPress sites. This zero-day remote code execution vulnerability allowed attackers to access the admin area, run malicious code, and upload harmful scripts on sites running older versions of the plugin (versions 6.0 to 6.8). While the developers released a patched version (File Manager 6.9) within hours, over 300,000 sites remained vulnerable because users hadn’t updated their plugins, and hackers quickly exploited this delay.

This example shows how dangerous a simple delay in applying updates can be, making it clear that user negligence in updating plugins is a major cause of WordPress hacks.

Abandoned plugins

Abandoned plugins are a ticking time bomb for many WordPress sites. Although the WordPress team permanently removes some of these plugins from its repository, many remain active on websites without ongoing maintenance or security updates.

In 2023 alone, 827 plugins and themes were reported as abandoned — significantly up from 147 in 2022. Of these, more than half (58.16%) were permanently removed due to serious security concerns.

For example, the Eval PHP plugin was abandoned for over a decade before hackers began exploiting it in 2023. The plugin, which was originally designed to let users execute PHP code within WordPress posts and pages, became a tool for attackers to inject backdoors into websites. Because Eval PHP was no longer maintained, the security vulnerabilities remained unpatched, and hackers took advantage of this, using the plugin to gain unauthorized access to websites.

Once inside, attackers could steal sensitive information, take full control of a site, or use it as part of larger malicious campaigns, like DDoS attacks. Even removing the plugin didn’t necessarily resolve the issue — hackers could persist on compromised websites by hiding backdoors in the site’s content.

This highlights the dangers of using abandoned plugins. When a plugin is no longer maintained, its vulnerabilities become permanent entry points for hackers. Website owners must be proactive in removing such plugins and replacing them with supported alternatives to keep their sites secure.