I have been looking at the OWASP Top 10, and am wondering which of the top 10 security risks are relevant to a WordPress installation with various plugins installed?
I know injections and XSS are relevant for sure, but what about the others?
Tell me more
×
IT Security Stack Exchange is a question and answer site for
IT security professionals. It's 100% free, no registration required.
|
|
|
Well. Most of them can, depending on what you do and how your server is configured, apply to WordPress (or any other CMS software really).
Of course injection (not necessarily just SQLi) is always a possibility.
If there's user supplied data and its echoed back, its probably been vulnerable at some point
There's an admin console to log into, maybe its got poor session management?
Can you access any files (like a database file for example) directly?
Can you trick users into accidentally doing things they didn't intend on your site?
What options are available in WP? If you don't set them correctly will it reduce your overall security?
Is WP storing credentials securely? Hashing passwords using something that isn't unsalted MD5?
Should the public be able to access the admin console URL? Can they access admin pages directly without logging in first?
Do you have SSL/TLS enabled? This isn't so much a WP thing so much as a general security best practice.
Can attackers trick WP users into being redirected to malicious sites? The following types of vulnerabilities have been, at some point, confirmed to have existed in WordPress software: Denial of Service, XSS, Information Leakage, Privilege Escalation, Code Execution, SQLi, Unauthenticated Bypassing to access files, XSRF and Directory Traversal. Source: CVEDetails Hope that helps! |
|||
|
|
The best thing to do is to look at the CVE Details website for Wordpress. There are a number of vulnerabilities mentioned against various versions. You'll see that CVE-2012-4448 is a CSRF vulnerability (OWASP 2010-A5). |
|||
|
