WordPress vulnerabilities more than doubled in 2021

WordPress vulnerabilities more than doubled in 2021, and 77% of them are exploitable, according to new reports from Risk Based Security.

"As we continue our mission to provide our customers with the best vulnerability intelligence available, we observe many shifts in the landscape," the company says.

"We've seen Bugtraq fall out of favour, the rise of Patch Tuesdays, felt the full force of the Vulnerability Fujiwhara Effect, and also witnessed the rise of GitHub as a significant medium for vulnerability disclosures.

"But as we look back on 2021, our independent research team observed a new trend: a huge increase in the number of vulnerabilities affecting WordPress plugins."

WordPress Plugin Vulnerabilities Up by 142%
Risk Based Security says 10,359 vulnerabilities were reported to affect third-party WordPress plugins at the end of 2021. Of those, 2,240 vulnerabilities were disclosed last year, which is a 142% increase compared to 2020.

While the spike in WordPress plugin vulnerabilities is itself alarming, the primary concern is their potential for exploitation. Out of all known WordPress plugin vulnerabilities, 77% of them have known public exploits.

"If CVSS severity scores are the basis for your organisation's vulnerability prioritisation, you may need to shift your focus to properly triage this risk," Risk Based Security says.

Shift Focus to Exploitability, Not Criticality
"On average, the CVSSv2 score for all WordPress plugin vulnerabilities is 5.5, which by many current VM frameworks is considered a "moderate" risk, at best," the company says.

"But, if you compare this data point with news headlines, you might observe a slight disconnect between conventional Vulnerability Management practices and impact."

For many organisations, vulnerabilities that have a CVSS severity score beneath 7.0 are often not considered a high priority and may get relegated to the backlog. Since the average WordPress plugin issue is scored 5.5, is it safe for organisations to instantly de-prioritise these issues? Risk Based Security says the answer is no.

"We've been preaching this shift from criticality to exploitability for a while now, and we're seeing some other influential organisations take note.

"In the most recent Gartner Security - Risk Management Summit, Mitchell Schneider, principal analyst at Gartner, encouraged organisations to make vulnerability management less about mass patching and more about prioritising the most exploitable vulnerabilities. Recent events such as CISA BOD 22-01 also support this as they show that malicious actors are not favouring vulnerabilities with high CVSS severity scores, but are instead opting for ones that they can easily exploit."

Securing Your Organisation Against WordPress Plugin Vulnerabilities
Because of factors like exploitability and attacker location, WordPress plugin issues can pose a significant threat to organisations deploying at-risk assets, even if they may not appear "highly critical" at first glance.

In addition, WordPress plugin vulnerabilities may be especially dangerous for organisations relying on CVE/NVD, since they will be unaware of 60% of issues with known public exploits.

"This intelligence gap is made even worse when considering the state of the WordPress plugin ecosystem," Risk Based Security says.

"There are over 58,000 free plugins for download, with tens of thousands more available for purchase. Unfortunately, few of them are designed with security in mind, so one vulnerability could potentially affect millions of users.

"It will likely be a difficult undertaking for organisations to identify which of their plugins have a public exploit. While there are several companies that specialise in WordPress security that maintain their own curated plugin vulnerability databases, they still do not offer the same breadth or depth of WordPress vulnerability information that we do."

Adopting a Risk-Based Approach
To fully understand the impact of these vulnerabilities, organisations will need to adopt a risk-based approach, Risk Based Security says.

"Although some WordPress plugins claim to have over 500,000 installs, it doesn't necessarily mean that all enterprises use them. Security teams will need to have knowledge of their assets, comprehensive vulnerability intelligence for all known issues, and detailed metadata, that allows them to examine factors like exploitability, to then contextualise the risk it poses to their environment."

Risk Based Security says says security professionals should start with vulnerabilities that are remotely exploitable, have a public exploit, and have a known solution.

"And if WordPress plugin issues affect important assets, these vulnerabilities should be triaged first. By remediating these types of issues, organizations can best protect themselves against potential attacks while saving time since solution data is available," it says.

"This risk-based approach will prove to be more effective than traditional Vulnerability Management models based on severity."

There are several security tools out there that focus on WordPress related vulnerabilities. However, each tool specialises in different functions meaning that organisations would have to purchase and deploy all of them to achieve maximum efficiency.

"Instead, organisations are better off relying on a comprehensive, detailed, and timely source of vulnerability intelligence that covers all known issues in IT, OT, IoT, and third-party libraries and dependencies."