Latest / Wpfavs - Your favourite WordPress news / Five Hours to Exploitation: Rethinking WordPress Security

Transcript

Five Hours to Exploitation: Rethinking WordPress Security · Wpfavs - Your favourite WordPress news

• 0:13
  Last time we left a question hanging.
• 0:15
  When AI agents get database and system access to a WordPress site,
• 0:19
  who holds the keys, and who audits the code?
• 0:22
  Today we're going underneath that question, because there's a more basic problem.
• 0:25
  The way most agencies handle updates may already be broken.
• 0:29
  And it's a problem I see constantly.
• 0:31
  The old playbook was simple.
• 0:33
  Run updates weekly or monthly, put a general web application firewall at the host,
• 0:38
  and clean up files if malware shows up.
• 0:41
  The State of WordPress Security 2026 report from Patchstack says that model has
• 0:46
  collapsed.
• 0:47
  The number that should bother you is five hours.
• 0:50
  That's the weighted median time to mass exploitation for heavily exploited
• 0:54
  vulnerabilities.
• 0:56
  Weighted means they account for how intense the attacks were.
• 0:59
  About half of the high impact vulnerabilities get exploited within 24 hours.
• 1:04
  Now put that next to a monthly update schedule.
• 1:06
  Thirty days against five hours.
• 1:08
  And it gets worse, because 46 percent of vulnerabilities published in 2025 had no
• 1:13
  developer patch at the moment of public disclosure.
• 1:17
  So even a perfect agency, one that updates the minute a notice lands,
• 1:21
  has nothing to install for nearly half of them.
• 1:24
  Updating is not a defense in that window.
• 1:26
  It's cleanup.
• 1:27
  And the volume is climbing.
• 1:29
  The ecosystem logged 11,334 new vulnerabilities in 2025, up 42
• 1:36
  percent from the year before.
• 1:38
  Of those, 1,966 were high severity, the kind likely to be hit by automated mass
• 1:44
  attacks, and that category was up 113 percent.
• 1:48
  One note.
• 1:49
  Patchstack classifies those severities, and Patchstack sells protection.
• 1:53
  It's the best data we have, but it comes from a vendor.
• 1:56
  Right, so weigh it as a good vendor dataset.
• 1:59
  Now the part that surprises people is hosting.
• 2:02
  Patchstack ran a large scale pentest of popular hosting companies,
• 2:06
  and only 26 percent of vulnerability attacks were blocked.
• 2:10
  In the targeted testing we've been given, it was only 12 percent.
• 2:14
  The reason is that the most exploited category is Broken Access Control.
• 2:18
  Those requests look like normal authenticated traffic.
• 2:22
  There's no obvious injection pattern for a general firewall to catch.
• 2:26
  So when a host says it has a WAF, that is not a patching strategy.
• 2:30
  Then there's the premium paradox, which I think agencies hate hearing.
• 2:34
  Components from marketplaces like Envato had three times more known exploited
• 2:39
  vulnerabilities than free plugins from the WordPress.org repository.
• 2:44
  And 76 percent of the vulnerabilities found in premium components were exploitable
• 2:49
  in real attacks.
• 2:50
  Patchstack's zero day program found 33 highly critical issues in premium components
• 2:56
  versus 12 in free ones.
• 2:58
  Their explanation is access.
• 3:00
  The code sits behind a paywall, so independent researchers rarely look at it.
• 3:04
  That's their reading, and I think it's fair.
• 3:06
  It says fewer eyes, not necessarily worse developers.
• 3:09
  And this ties back to our open question.
• 3:12
  This week's news had Angie from the Elementor team shipping a super admin mode that
• 3:17
  can read and write the file system, query the database and execute PHP.
• 3:22
  Novamira and SproutOS offer similar reach through MCP.
• 3:26
  I want to be clear that this next part is my interpretation,
• 3:30
  not from the report.
• 3:32
  The more power that sits inside a site, the less time you can afford between a
• 3:37
  disclosure and a defense.
• 3:39
  Five hours is not much time to audit anything.
• 3:42
  And attackers aren't just getting faster, they're getting quieter.
• 3:45
  Patchstack partnered with Monarx, who looked at about nine trillion file signals.
• 3:50
  Uploader scripts nearly doubled in mid 2025 and stayed high.
• 3:54
  That means attackers want a persistent way back in, so they can drop secondary
• 3:58
  payloads long after your cleanup.
• 4:00
  They also rarely drop a standalone bad file.
• 4:03
  They inject small snippets into legitimate core and plugin files.
• 4:07
  Which makes cleanup painful.
• 4:09
  One family called Lock360 runs resident in server memory, and it rewrites cleaned
• 4:14
  index.php and .htaccess files within seconds of restoration.
• 4:19
  So you think you fixed it, and it undoes your fix before you've closed the tab.
• 4:23
  When it comes to recovering a client site, that's a different job than deleting a
• 4:27
  file.
• 4:27
  And this one is my area, because it touches AI visibility.
• 4:31
  A campaign called Parrot TDS inspects each request and serves different things to
• 4:35
  different visitors.
• 4:37
  Keyword spam goes to search bots, exploits go to human visitors,
• 4:40
  and clean, unmodified pages go to AI training crawlers like ChatGPTBot and Google
• 4:46
  Gemini.
• 4:47
  So if your audit is an AI tool reading your site, it may report a clean page while
• 4:52
  real visitors get attacked.
• 4:54
  A view through an AI reader is useful, but it can't be your only check.
• 4:57
  One more timing detail.
• 4:59
  Malicious file uploads triple in November and December.
• 5:02
  Attackers aim at peak shopping traffic and skeleton agency staffing.
• 5:06
  So the worst week for an incident is the week your team is on holiday.
• 5:10
  So here's a practical workflow.
• 5:12
  First, move from post boom to pre boom.
• 5:15
  That means application level virtual patching, something like Patchstack's
• 5:19
  RapidMitigate, which blocks exploit patterns in real time without changing source
• 5:24
  code.
• 5:25
  Yes, that's a vendor product, and you should compare options.
• 5:29
  But the principle is that protection arrives at disclosure,
• 5:32
  not when the author ships a fix.
• 5:34
  Second, least privilege.
• 5:36
  Use something like Melapress Role Editor to trim who can do what,
• 5:40
  turn on two factor authentication with WP 2FA, and lock down file permissions on
• 5:45
  production so a compromised plugin can't write wherever it likes.
• 5:49
  Third is vetting, and I'd say treat every plugin as untrusted third party code.
• 5:54
  Does the vendor run a verified vulnerability disclosure program?
• 5:58
  Does it lean on unmaintained dependencies?
• 6:01
  When you uninstall it, does it clean up its database tables and options,
• 6:05
  or leave orphans behind?
• 6:07
  And ask whether you need it at all.
• 6:09
  Every redundant utility plugin is more surface for those five hours.
• 6:13
  There's regulatory pressure here too.
• 6:15
  The EU Cyber Resilience Act now pushes commercial plugin vendors toward a formal
• 6:20
  disclosure program.
• 6:21
  At the same time, maintainers are drowning in AI generated slop reports,
• 6:26
  invalid bug bounty submissions that eat engineering time.
• 6:30
  So the people who have to patch fast are also being buried in noise.
• 6:34
  And core isn't exempt.
• 6:36
  WordPress 7.0.2 was an emergency security release, fixing a REST API batch route
• 6:42
  confusion and SQL injection that could lead to remote code execution,
• 6:46
  plus a separate facilitated SQL injection issue.
• 6:50
  If you haven't updated every site to it, you can do that in just a few clicks with a
• 6:53
  bulk tool, so do it today.
• 6:56
  So here's the takeaway.
• 6:57
  The question from last time was who holds the keys.
• 7:01
  This one is who's watching at hour five.
• 7:04
  This week, audit your clients' plugin lists, flag the premium and abandoned ones,
• 7:09
  and decide what protects each site before the next disclosure,
• 7:13
  not after.