-- Security experts and hackers alike are well aware that out of date code leads to websites being hacked. Sites are routinely scanned looking for these vulnerabilities. Yet 10,000 websites that could have easily protected themselves are being hacked every single day.
“WordPress is one of the most popular targets for hackers, mainly due to it’s popularity. Over 2.5 million of the world’s top websites depend on it,” says MyTechGuy.co.nz, a New Zealand based website management service. “WordPress has a large library of over 47,000 ‘plugins’ provided by it’s community of programmers to customise and provide additional features. Which creates a lot of opportunities for hackers to probe for weaknesses.”
It’s not just the risk of websites being taken offline that is causing major concern. This can of course mean instant loss of revenue for businesses. Many WordPress based sites however also use plugins for online e-commerce. Once such a site has been compromised, the attacker may well have the abilities to go on and steal customer data, including credit card information.
In April an old and insecure version of the WordPress plugin RevSlider was responsible for the data leak now known as the ‘Panama Papers’. 11.5 million documents were taken from Mossack Fonseca, the 4th biggest offshore law firm in the world.
As far back as 2011 a major vulnerability in a piece of code used for resizing images affected nearly 1.2 million sites. The result was hundreds of thousands of WordPress sites being redirected to rogue websites. The ‘TimThumb’ code was quickly fixed, yet 5 years later there are still many thousands of websites still using the vastly out of date insecure version. And this is far from an isolated case.
One of the most popular WordPress plugins is ‘Yoast SEO’. Downloaded over 35 million times, this highly useful plugin allows users to write better content and improve their websites appearance in Google. According to the latest data 79.9% of the actively installed versions of this code are out of date. 45% of sites are still using a version more than 7 months old with numerous well known security problems. More information is available about out of date WordPress plugins and the need to update them here: https://mytechguy.co.nz/blog/why-update-wordpress-plugins/.
WordPress itself is no stranger to this problem either. Version 4 of WordPress has been available and regularly updated for over 2 years now. Yet over 11% of WordPress sites (source: W3Techs) are still using older versions, with as many as thousands of sites failing to have updated for over 11 years.
Website owners can however protect themselves.
The quickest and easiest measure website owners can take is to apply updates as and when they become available. Particularly when those updates specifically include security fixes. Ideally this process should be managed by an in-house IT specialist. Small businesses can however outsource this responsibility to website management services such as mytechguy.co.nz.
Software updates are both a blessing and a curse. But the need for businesses to keep devices and websites safe and secure depends on regular updating more so now than ever before. It’s a problem that will only continue to grow.
Further information: WordPress is one of the most popular Content Management Systems, with a market share over 60%. Of the top 10 million websites, 26.6% now depend on it. WordPress currently has 47,795 plugins listed in their online directory with 1.4 billion downloads between them. Out of a sample of 11,000 hacked websites, 75% of those were using WordPress. Over 50% of them were running old versions (source: Sucuri). Google reports blacklisting over 70,000 new compromised websites every week to protect searchers from malware and phishing attacks (source: Google, March 2016).
Release ID: 148763