WordPress, a free, open source blogging tool, is the most popular blogging system on the web, even surpassing Blogger, Microsoft SharePoint and Drupal. WordPress also serves as a content management system (CMS). The popularity of this platform has made it a favorite among hackers. In particular, its plugin architecture and template system, which are based on PHP and MySQL, make the platform vulnerable in several ways. With over 30,000 official WordPress plugins, the seriousness of the vulnerability problem cannot be overstated. Need Search Engine optimization as well ?
Vulnerabilities keep emerging and re-emerging as new themes, plugins and WordPress are introduced. In general, new updates offer most WordPress fixes, which helps most WordPress site owners stay a step ahead of the hackers. However, a new version may introduce a new or a worse vulnerability, or even create vulnerabilities where none existed. In such cases, the best fix could be as simple as reverting to an earlier version of the theme. Owners host about half of all WordPress sites, which means that knowing common WordPress fixes to certain vulnerabilities is very important.
- Security Bypass Vulnerabilities
WordPress keeps introducing plugins to improve the functionality or the appearance of its sites. However, some of these plugins usually come with security vulnerabilities that can allow unauthorized access to privileged resources. The worst-case scenario is when these security threats allow the hackers to modify security information and take command of the vulnerable sites. Security bypass vulnerability is mostly introduced by new plugins, for instance, the Mobile Pack plugin.
WordPress’ Mobile Pack Plugin allows security bypass that gives access to password-protected posts, a problem that can be fixed by updating to version 2.0.2 of the plugin. The WPTouch Plugin also fails to restrict access to certain administrative functions, which can allow hackers to upload and execute server-side codes. This problem affected versions 3.4.2 and possibly prior versions, but installing version 3.4.3 will fix the problem.
- Inadequate Access Restrictions to Sensitive Files
A general WordPress installation results in creation of some sensitive files that, in the wrong hands, can create serious security vulnerabilities. Hosts may provide the ability to view site directories as part of their default settings. When the directories contain sensitive information, and are accessible to malicious parties, they can be modified to seriously compromise the a site security.
Any files that the owner feels could easily expose sensitive information should have its access privileges tightened. The changes should allow the files to be viewed and modified only by the administrator, for instance, files with configuration information. Modifications can be made to the .htaccess file to restrict access to any sensitive files. The website owner can also create a whitelist of any links allowed access to certain directories.
- Attempts to Hack the Admin User Account
Some hackers are quite resourceful and persistent in their attempts to gain administrative privileges to a site. The default admin account increases the susceptibility to such attacks since the hackers know right away that getting the password to the admin’ account will give them unlimited access to the site. The hackers can achieve this by using automated scripts that are able to make relentless login attempts that may eventually succeed.
The knowledge that the hackers only have to succeed in getting the password for a certain account to have administrative privileges is a definite plus for them. This edge can be eliminated by deleting the admin’ account, and using a generic name to create a user account and then assigning it the administrative privileges associated with the admin’ account. The hackers’ task is therefore magnified as they would have to try and hack every account on the site and succeed, in order to gain access to the site, which is obviously much more difficult. In addition to getting rid of the admin account, site administrators can also use a plugin that inhibits enumeration of users, which prevents the hackers from knowing the names of site users.
- Cross-Site Scripting (XSS) Vulnerabilities
A number of plugins on WordPress allow hackers to execute client-side attacks through injection of scripts into web pages viewed by site users. This vulnerability allows attackers to execute HTML codes on the browsers of the users in the context of the vulnerable site. For instance, some Photo Gallery and WooCommerce plugin versions released recently have this problem. In both of these plugins and other plugins offering the same vulnerabilities, input passed through sensitive admin files is not adequately sanitized before being returned to the user, which means the output contains sensitive administrative information that can be exploited by hackers.
Most of the cross-site scripting problems are recognized early enough and reported. Usually, subsequent updates specifically resolve these issues. However, before safer updates are available, site owners who have installed such updates can remove them until safer versions are available.
- The WordPress Tag
As it has already been established, being a WordPress site makes it more vulnerable to attacks. WordPress sites are vulnerable because of their numerous unsafe themes and plugins, which WordPress sites vulnerable. When hackers have not way of knowing whether a site runs on WordPress, they are more than likely to stay away, indirectly reducing a site’s vulnerability.
If hackers dedicated to taking down WordPress sites could be convinced that a site did not run on this popular platform, the site would be less susceptible to attacks. WordPress site owners can get rid of the “WordPress Site” tag by removing mentions of the word from the site.
The “Powered by WordPress” is usually the first obvious giveaway. Site owners can also get rid of backlinks to the WordPress site from your site and redirect to functions.php file, which hides the WordPress version of the site from attackers.
In general, WordPress site owners can reduce the number of vulnerabilities on their sites by knowing some of these WordPress fixes. In addition, any unwanted plugins should be removed, considering that plugins introduce a majority of vulnerabilities to WordPress sites. More importantly, it is critical to stay updated on any issues relating to WordPress vulnerabilities. This way, a site will not become an easy target for malicious users. Sites such as Secunia.com keep a comprehensive and updated list of WordPress vulnerabilities, and their solutions, if any.