Patchstack Whitepaper: WordPress Ecosystem Records 150% Increase in Security Vulnerabilities in 2021
Patchstack has published its State of WordPress Security whitepaper with a summary of threats to the WordPress ecosystem recorded in 2021. The whitepaper aggregates data from multiple sources, including the Patchstack Vulnerability Database, the Patchstack Alliance (the company’s bug bounty platform), and publicy reported CVEs from other sources. In 2021, Patchstack recorded nearly 1,500 vulnerabilities, a 150% increase as compared to 2020, which recorded ~600. Patchstack found that the majority of these come from the WordPress.org directory: The WordPress.org repository leads the way as the primary source for WordPress plugins and themes. Vulnerabilities in these components represented 91.79% of vulnerabilities added to the Patchstack database.The remaining 8.21% of the reported vulnerabilities in 2021 were reported in premium or paid versions of the WordPress plugins or themes that are sold through other marketplaces like Envato, ThemeForest, Code Canyon, or made available for direct download only. WordPress core shipped four security releases, and only one included a patch for a critical vulnerability. This particular vulnerability was not in WordPress itself but rather in one of its bundled open source libraries, the PHPMailer library. Patchstack estimates that 99.31% of all security bugs from 2021 were in components – WordPress plugins and themes. Themes had…
…Full post on WP Tavern
Read Full
