By RyskenUpdated 2 min read
WordPress powers a very large share of websites, so it attracts constant automated scanning. The good news is that most successful attacks use a short list of well-understood weaknesses. If you know what they are, you can close most of the doors that matter.
1. Vulnerable or outdated plugins and themes
The single most common route in. Plugins and themes are third-party code with varying quality, and vulnerabilities are discovered and published regularly. Attackers scan for sites running affected versions. Fix: remove anything unused, apply security updates promptly, prefer actively maintained components, and review what you install. See vulnerability remediation.
2. Weak, reused or stolen credentials
Brute-force and credential-stuffing attacks try common or leaked passwords against wp-login.php. Fix: strong unique passwords, multi-factor authentication for administrators, login rate limiting and no shared accounts.
3. Excessive user privileges
When everyone is an administrator, one compromised account compromises the site. Fix: least privilege, remove dormant users, and review roles regularly.
4. Injection vulnerabilities (including SQL injection)
Unsanitised input reaches the database or server and lets an attacker read or change data. Fix: keep components updated, and ensure custom code validates input and uses prepared statements.
5. Cross-site scripting (XSS)
Malicious scripts run in a visitor’s or administrator’s browser, enabling session theft or actions on their behalf. Fix: output escaping in custom code, updated components, and a sensible Content Security Policy.
6. Cross-site request forgery (CSRF)
A logged-in user is tricked into performing an unwanted action. Fix: nonces and capability checks in custom code, and keeping plugins current.
7. Insecure file handling
Unrestricted uploads or writable directories let attackers place executable files. Fix: restrict upload types, block PHP execution in uploads, and apply correct file permissions.
8. Information disclosure
Exposed backups, debug logs, configuration files or version details help attackers plan. Fix: remove stray files, disable debug output on production and restrict directory listing.
9. Security misconfiguration
Missing HTTPS, absent security headers, an exposed XML-RPC or REST endpoint you do not need, weak server settings. Fix: a configuration review; see WordPress hardening and our hardening checklist.
10. Poor update and backup practice
Sites that are rarely updated or lack tested off-site backups turn small incidents into long outages. Fix: a documented update routine and restore tests.
Finding out where you stand
A WordPress security assessment checks your site against exactly these categories, and VAPT validates which weaknesses can be exploited. Contact us to scope it.
