WordPress Security: Vulnerabilities and How to Improve Security

Manieendar Mohan
Published on
21 Jul 2020
6 min read

All websites are not created equally. Any website can experience technical issues but with a WordPress website you’re also leaving yourself exposed due to its vulnerable nature.

According to W3Techs, 37.8% of all websites are powered by WordPress.

WordPress runs on open source code and has a team of dedicated engineers to identify and fix security issues that occur in the core source code. As soon as a security vulnerability is disclosed, a security patch is immediately pushed.

That’s why managing WordPress and keeping it updated to the latest version is incredibly essential to the overall security of your website.

WordPress security vulnerabilities extend beyond the WordPress core. It is also prevalent in the themes and plugins that are being incorporated into a particular website.

As recently reported by wpvulndb, out of the 21,675 known WordPress security vulnerabilities:

  • 17% are from WordPress plugins

  • 80.5% are from the WordPress core

  • 2.5% are from WordPress themes

WordPress graph

Being an open-source platform, it attracts a lot of hackers. A hacker intends to get unauthorized access to the website on an administrator-level, either from the frontend or on the server-side.

WordPress Security Vulnerabilities

If you maintain a WordPress-powered website or do consider using WordPress as your CMS, you should be concerned about the possible WordPress security issues. Here, I’ll outline several common WordPress security vulnerabilities:

  • Unauthorized Logins

  • Cross-Site Scripting

  • SQL Injections

  • File Inclusion Exploits

  • Denial-of-Service Attacks

Unauthorized Logins

Unauthorized logins are typically performed by “brute-force”. In a brute-force login, the attacker uses a tool to send multiple HTTP requests with a different combination of potential username-password combinations.

If fortunate, they will eventually get the right credentials and obtain access to the application.

The primary reason why this type of attacks happen successfully on WordPress sites is because the default administrator login page of any given WordPress site is simple to find. We can find it by appending “/wp-admin” or “/wp-login.php” to the end of the website’s main URL.

Cross-Site Scripting

84% of total security vulnerabilities on the whole internet are cross-site scripting attacks.

Cross-site scripting (XSS) vulnerabilities are the most common vulnerabilities found in WordPress plugins. The fundamental mechanism of cross-site scripting is that an attacker finds a way to get a victim to load web pages with malicious javascript code.

XSS mostly targets the functionality of the web page.

Hackers might try to harm visitors by posting a disguised link to a malicious website or displaying a pretended contact form to steal user information by misleading them.

WordPress plugins and themes are primarily responsible for this. If an attacker comes across an outdated theme or poorly-maintained plugin on a website, they can exploit it for passage to files that compose your website’s frontend.

SQL Injection

WordPress websites use MySQL database to operate and Structured Query Language is used for database management.

SQL injections happen when an attacker obtains access or is able to inject data into the database. Websites are essentially just data that is pulled from a database and displayed attractively in your browser.

The consequence of an SQL injection is very critical.

Attackers can inject SQL queries that can create new user accounts, add unauthorized content, leak, edit, or delete data.

Attackers usually make use of visitor-facing submission forms such as contact forms or lead forms to access WordPress SQL databases in the backend.

File Inclusion Exploits

A WordPress website’s PHP code is the next most popular security issue that is exploited by attackers. PHP is the server-side programming language WordPress is built on.

File inclusion exploits happen when vulnerable PHP code is used to load remote files that are in the server. File inclusion exploits are one of the most common ways an attacker can gain access to wp-config.php which is in fact the WordPress configuration file.

Denial-of-Service Attacks

A Denial-of-Service (DoS) is a type of attack where the server is flooded with requests, eventually blocking permission to visitors including the administrators.

These attacks are often carried out from multiple machines at the same time (forming a botnet), which will hide the origin of the traffic and increase the volume of spam, also known as distributed denial-of-service (DDoS).

What Makes a WordPress Website Vulnerable

Some of the main reasons that make a WordPress website vulnerable include:

  • Weak passwords

  • Not frequently updating plugins and themes

  • Using plugins and themes from untrustworthy sources

  • Using poor-quality or shared hosting

How to Improve WordPress Website Security

You can keep your WordPress website secure and prevent data breach or loss by following certain security best practices. They are:

  • Having a strong password policy so that users need to provide longer and more secure passwords

  • Enabling two-factor authentication

  • Frequently updating WordPress core, themes and plugins

  • Implementing proper permissions for web server’s directory

  • Scheduling vulnerability and malware scans on a regular basis

  • Keeping a reliable and effective backup plan

  • Activating brute force protection


While security concerns for WordPress websites certainly exist, most of it can be avoided by following security best practices. Beagle Security offers a WordPress security testing tool that allows you to keep track of your website’s security regularly, thereby giving you protection from hackers.

If you have any more thoughts or suggestions on WordPress security please do leave a comment below.

Automated human-like penetration testing for your web apps & APIs
Teams using Beagle Security are set up in minutes, embrace release-based CI/CD security testing and save up to 65% with timely remediation of vulnerabilities. Sign up for a free account to see what it can do for you.

Written by
Manieendar Mohan
Manieendar Mohan
Cyber Security Lead Engineer
Find website security issues in a flash
Improve your website's security posture with proactive vulnerability detection.
Free website security assessment
Experience the power of automated penetration testing & contextual reporting.