WordPress vulnerabilities

Where WordPress vulnerabilities come from

WordPress itself is checked by a large security team and fixed quickly, and since version 3.7 minor security releases install automatically. Most WordPress sites that get broken into are not running a vulnerable WordPress core: the way in is usually one of three other things.

• Plugins. The large majority of published WordPress vulnerabilities are in plugins, often small ones maintained by one person. A plugin that has been abandoned will never get its fix.
• Themes. Themes run code too, and a theme bought once and never updated carries every flaw found in it since.
• Accounts. Weak or reused administrator passwords and logins without a second factor are guessed or stuffed from other breaches.

How to find your WordPress version

• In the dashboard: Dashboard › Updates shows the version you run and whether a newer one is out. The version is also at the bottom right of most admin pages.
• With WP-CLI on the server: wp core version.
• In the files: wp-includes/version.php holds it as $wp_version.

Enter that number in the check above to see the advisories that apply to it. For a plugin, the version is on the Plugins page; enter the plugin's name and version in the vulnerability lookup the same way.

Keeping a WordPress site safe

1. Keep WordPress core, every plugin and every theme up to date, and turn on automatic updates for plugins you trust.
2. Delete plugins and themes you do not use. Deactivated code is still on the server and can still be reached.
3. Replace plugins that have not been updated in a year or more.
4. Give every administrator their own account, a unique password and two-factor sign-in.
5. Keep backups that are stored away from the web server, and test that they restore.

Think your WordPress site has been injected with malware?

Signs include redirects to unfamiliar sites, spam pages you did not write, unknown administrator accounts, and PHP files with names you do not recognise in wp-content/uploads, where no code should live. Change every administrator password, take a copy of the site for evidence, and check suspicious files with the free malware scan one at a time. Then reinstall WordPress core and your plugins from their official sources rather than trying to clean them by hand, and update everything before putting the site back online.

If the site runs on a server you manage, our endpoint agent can watch it for you: it raises an alert when a script file is written into a web server's folders, a common sign of a web shell. See how to scan a server for malware.