A recent study by network operator Akamai confirms the poor reputation of WordPress plugins as a target for numerous attacks. During the one-week observation period, 43,000 attacks on WordPress installations were recorded via various plugins. Eight plugins are particularly popular targets: Tim Thumb (72%), MyFlash (16%), openEMR (7%), and the following five at 1% each: Bti Team Bti Tracker, Is-human, WordPress Cloudsafe365, Comment Rating, and MyGallery. The most popular intrusion method is “Remote File Inclusion,” which stands out significantly, accounting for 96% of the attack types.
The study also contains several other interesting statistics.
The conclusion, however, is certainly not that plugins should not be used; rather, they should be integrated with care. Information in the WordPress Plugin Directory regarding developers, the latest updates, and reviews can help with this. Users should also take the time to update plugins promptly, especially when security-relevant issues become known.
