Vulnerable plugins, extensions, and default settings are responsible for a high rate of website compromise, according to new research.
Content management systems (CMSs) are frequently used to structure websites and online services, including e-commerce shops, and make it easier for web admins to manage and publish content.
Plugins and extensions add to website functionality and can provide everything from contact forms to SEO optimization, maps, image albums, and payment options. As a result, they are incredibly popular — but if they are vulnerable to exploitation, their use can put entire websites at risk of being hijacked.
Sucuri’s 2021 Website Threat Research Report (.PDF) has examined these issues in-depth with a particular focus on CMS usage, including WordPress, Joomla, and Drupal.
According to the researchers, vulnerable plugins and extensions “account for far more website compromises than out-of-date, core CMS files,” with roughly half of website intrusions recorded by the firm’s clients occurring on a domain with an up-to-date CMS.
Threat actors will often leverage legitimate — but hijacked — websites to host malware, credit card skimmers, or for the deployment of spam. Sucuri says that websites containing “a recently vulnerable plugin or other