The Raw Numbers: A Plugin Vulnerability Landscape
A comprehensive mapping of every WordPress plugin CVE since 2023 reveals a stark reality: a significant number of plugins with publicly disclosed vulnerabilities remain readily available and actively installed. The analysis, which tracked 15,534 vulnerability records across 8,010 plugins, found that 3,780 plugins have been removed from the official WordPress.org plugin directory. While removal halts updates, it does not uninstall the plugin, leaving sites running potentially compromised code.
More concerning, 277 of these plugins carried a critical flaw (CVSS score 9.0 or higher) before their removal. The most alarming statistic, however, is that 2,115 plugins are still installable today and possess known vulnerabilities with no update released in over 12 months. These vulnerable plugins are collectively active on approximately 6.7 million websites, creating a massive attack surface.
The lack of clear user notification for plugin removal is a critical blind spot. Site owners are often unaware that a plugin they rely on is no longer supported or has been flagged for security issues. The WordPress dashboard offers no explicit warning for removed plugins, and no email notification is sent. This leaves administrators in the dark, continuing to use software that could expose their sites to serious security threats.
Building the Dataset: Transparency and Reproducibility
The methodology behind this analysis emphasizes transparency and reproducibility. The creator set out to move beyond anecdotal advice on plugin safety, aiming for data-driven insights. The process involved systematically collecting CVE data specifically for WordPress plugins. This data was then cross-referenced with information from the WordPress.org plugin directory to determine the status of each plugin – whether it was removed, still active, or updated.
Key data points collected for each vulnerability included the CVE ID, CVSS score, the plugin name, its version history, and its status within the WordPress ecosystem. The analysis focused on vulnerabilities disclosed since the beginning of 2023, providing a current snapshot of the plugin security landscape. The goal was to create a dataset that could be independently verified, allowing others to scrutinize the findings or extend the research.
This meticulous approach is crucial because the perception of plugin safety is often based on subjective assessments rather than concrete data. By providing the exact methodology and the raw data (or the means to replicate its collection), the analysis aims to empower users and developers with the information needed to make informed decisions about plugin usage. It highlights the need for better automated security checks and clearer communication channels within the WordPress ecosystem regarding plugin risks.
The Implications: What This Means for Site Owners and Developers
The prevalence of vulnerable, yet still installable, WordPress plugins presents a clear and present danger. For site owners, it means that simply installing a plugin from the official directory does not guarantee its security. The reliance on automatic updates is also compromised if the plugin itself is no longer maintained, even if it hasn't been officially removed. The lack of dashboard warnings for removed plugins exacerbates this issue, making manual audits and security vigilance essential.
For developers, this data underscores the responsibility that comes with creating and maintaining plugins. It highlights the importance of timely patching and the potential long-term consequences of abandoning plugins without proper sunsetting procedures. The analysis also points to a need for improved security tooling within the WordPress development lifecycle and better integration of vulnerability scanning into the plugin submission and review process. The fact that millions of active installs are running on unpatched, vulnerable code suggests a systemic issue that requires attention from both the WordPress core team and the broader plugin developer community.
The surprising detail here is not just the sheer number of vulnerable plugins, but the extent to which they remain accessible and actively used. This situation is akin to a city continuing to sell building permits for structures with known, critical structural flaws, without any public notice. The potential for mass exploitation, from data breaches to website defacement and botnet recruitment, is significant. Users must understand that plugin security is an ongoing process, not a one-time check. Regular auditing of installed plugins, especially those not updated in a year or more, is now a non-negotiable part of website maintenance.