WordPress vulnerability monitoring

What is a WordPress vulnerability?
A WordPress vulnerability is a proven breach, via WordPress Core, WP plugins or WP theme (or combination of these). Security experts and freelance programmers, find these vulnerabilities in the public code (latest released version). They always contact the person responsible to correct the code at first and keep these findings in utmost secrecy to prevent a global issue for millions of WordPress owners. They also provide proof of concept with a description, tools used, steps to reproduce when they found a vulnerability. Mostly these vulnerabilities are duplicated, accepted by creators and fixed within days/weeks. When public patch (version correcting the reported vulnerability) is released, then the information regarding all these is disclosed to the public, in a transparent report. You can check even our blog for WordPress Core and plugin vulnerabilities, reported monthly.

WordPress vulnerability monitoring recorded 320 WordPress Core vulnerabilities in total since 2004. These are classified into one of the following categories:

• XSS – 123 reported, since 2004. Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users.
• HTTP Response Splitting – 1 reported, in 2004. HTTP response splitting is a failure of the application or its environment to properly sanitize input values. It can be used to perform cross-site scripting attacks, cross-user defacement, web cache poisoning, and similar exploits.
• Remote Code Execution – 54 reported, since 2005. The RCE attack (Remote Code Execution) could be used by unauthenticated remote attackers to gain instant access to the target server on which a vulnerable WordPress core version was installed in its default configuration which could lead to a full compromise of the target application server.
• SQL Injection – 38 reported, in 2005. SQL injection is the placement of malicious code in SQL statements, via web page input.
• Gain Information – 32 reported, since 2005. Vital information substracted by different means. This information then is used to formulate other types of attack, more capable to reach targeted the end goal.
• Denial of Service – 17 reported, since 2006. DoS (Denial of Service) attacks occur when a hacker floods a website with too much traffic for it to handle, causing it to slow down or shut down altogether. Also known as DDoS or Distributed Denial of Service attack, when several attack points are used in parallel, with the same scope.
• Directory Traversal – 13 reported, since 2006. A directory traversal (or path traversal) consists in exploiting insufficient security validation/sanitization of user-supplied input file names, to gain unauthorized access to the file system. This attack exploits a lack of security (the software is acting exactly as it is supposed to) as opposed to exploiting a bug in the code.
• Bypass Something – 33 reported, since 2007. Bypass, in general, means either to go around something by an external route rather than going through it, or the means of accomplishing that feat. In WordPress security, a bypass is a flaw in a security system that allows an attacker to circumvent security.
• CSRF – 21 reported, since 2007. Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions on a web application in which they’re currently authenticated. CSRF attacks specifically target state-changing requests, not theft of data since the attacker has no way to see the response to the forged request.
• Exploits – 17 reported, since 2007. There are known security issues even in some of the most recent releases of WordPress core, so check the discovered version against the known vulnerabilities. Exploits usually mix two (or more) attack types.
• File Inclusion – 2 reported, since 2008. The File Inclusion vulnerability allows an attacker to include a file, usually exploiting a “dynamic file inclusion” mechanisms implemented in the target application. The vulnerability occurs due to the use of user-supplied input without proper validation.
• Gain Privilege – 1 reported, in 2009. Privilege escalation is the act of exploiting a bug, design flaw or configuration oversight in an operating system or software application to gain elevated access to resources that are normally protected from an application or user.

How to monitor WordPress vulnerabilities?

• On-demand, manually – You search over the internet for security issues reported for EACH plugin version installed (and above) and theme version installed (and above) with your WP Core version (and above). Scouring countless highly technical papers, on specialized web pages (and mostly content locked for members only view), however, can be a bit of a pain. Not impossible, just counter-productive.
• Constant Care – Want to avoid building up bad things and postpone the day when it comes crumbling down on your busy schedule as an avalanche? Say no more. Drop us a line and we’ll set up constant monitoring. Consulting included for results interpretation.
• For FREE? – Order a monthly recurrent WordPress Service from us, Business plan or higher and it has this included in the benefits package. How owlsome is this? :)