Back
Security threat caused by closed WordPress plugins

WordPress Plugins closed by WordPress.org security team still endangers thousands of websites

Plugins are the most common cause of WordPress website hacking. In February, we have found a security vulnerability in the Simple Contact Info plugin. The security vulnerability in the plugin allowed the logged-in user to delete any file on the website, for example, wp-config.php. Because the plugin was not updated for 3 years, we have sent the vulnerability information not to the author of the plugin but to the WP.org team, which had closed the plugin the following day, so that no one could download it anymore.

All 6,000+ WordPress sites are still vulnerable

By closing the plugin, only one problem is solved. Nobody could download this plugin with unresolved security vulnerabilities. However, Simple Contact Info plugin was used by 6,000+ websites, and after one month we still see that this number has not changed. It means that all 6,000+ websites have an “Arbitrary file deletion” vulnerability.

What could WP.org team do better?

  • Fix and release the new version – in our case, the correction of vulnerability would take only 1 minute, and updates – a few minutes more. Would not it be better to spend 10 minutes fixing the security issue by releasing a new version than leaving all 6,000+ websites vulnerable? Most vulnerabilities have the same symptoms and can be corrected very quickly.
  • Report about the closed plugin – WordPress still does not have any centralised reporting centre. It would be nice if you could see a closed plugin message in your WordPress administration window. We plan to integrate this function into our database and thus inform users about closed plugins.

How can you avoid threats caused by closed plugins?

You can use our WordPress Vulnerability Database and always receive a notification if any plugins you use have security issues. Our database is updated daily and currently has over 3,400 wide known WordPress plugins and themes vulnerabilities. We also recommend you to check regularly if your plugins are updated, and there are no compatibility issues. If you use the plugin for a year and it has not been updated all that time – it is time to worry. Also, you must remember – the more plugins you use, the higher the security risk, choose your plugins carefully.

Jack K.

Similar Posts

WordPress site hacked after restore

My WordPress website got hacked after restore. Again! Why?

Quite often we hear about the repeated security incidents related to WordPress sites. This is not something specific to WordPress sites, ...

PCI compliance WooCommerce

What is PCI compliance and do you need it for your WooCommerce store

PCI compliance or more precisely PCI DSS (Payment Card Industry Data Security Standard) developed by the Payment Card Industry Security ...

WordPress / WooCommerce secure

Is WooCommerce Secure? Is WordPress Secure?

The WordPress and WooCommerce websites that we run and maintain can be potentially problematic when you consider that they’re not always ...