Increasing vulnerability with the WordPress sites

WordPress is the most popular CMS on the Internet. An advantage of using a website building platform rather than building a site from scratch is that developers will continuously enhance the functionality and security of the platform to provide a seamless user experience.

Hackers are trying their hardest, and it’s up to you to secure your website even harder. WordPress sites are vulnerable to these attacks the same way as other security issues on this list: outdated plugins, themes, and core software. Successful brute attacks and undefined user roles can also make your site vulnerable.

WordPress powers over 43.3% of all websites on the internet, and with hundreds of thousands of theme and plugin combinations out there, it’s not surprising that vulnerabilities exist and are constantly being discovered. However, there is also a great community around the WordPress platform, to ensure these things get patched ASAP. As of 2022, the WordPress security team is made up of approximately 50 (up from 25 in 2017) experts including lead developers and security researchers — about half are employees of Automattic and a number work in the web security field.

WordPress developers roll out updates every three months or so. It’s strongly recommended that all WordPress users download these updates when they become available either manually or by enabling auto-updates. Each of these releases typically include improvements, bug fixes, and fixes to more critical security vulnerabilities. So updating your core files can help improve your site’s functionality, performance, and compatibility in addition to security.

A new malicious campaign has compromised over 15,000 WordPress websites in an attempt to redirect visitors to bogus Q&A portals. These malicious redirects appear to be designed to increase the authority of the attacker's sites for search engines. This extensive compromise allows the malware to execute the redirects to websites of the attacker's choice.

The search engine poisoning technique is designed to promote a "handful of fake low quality Q&A sites" that share similar website-building templates and are operated by the same threat actor.

Dr. Deepak Kumar Sahu, President & CEO, VARINDIA