I have been looking at the OWASP Top 10, and am wondering which of the top 10 security risks are relevant to a WordPress installation with various plugins installed?

I know injections and XSS are relevant for sure, but what about the others?


2 Answers 2


Well. Most of them can, depending on what you do and how your server is configured, apply to WordPress (or any other CMS software really).


Of course injection (not necessarily just SQLi) is always a possibility.

A2-Cross Site Scripting (XSS)

If there's user supplied data and its echoed back, its probably been vulnerable at some point

A3-Broken Authentication and Session Management

There's an admin console to log into, maybe its got poor session management?

A4-Insecure Direct Object References

Can you access any files (like a database file for example) directly?

A5-Cross Site Request Forgery (CSRF)

Can you trick users into accidentally doing things they didn't intend on your site?

A6-Security Misconfiguration

What options are available in WP? If you don't set them correctly will it reduce your overall security?

A7-Insecure Cryptographic Storage

Is WP storing credentials securely? Hashing passwords using something that isn't unsalted MD5?

A8-Failure to Restrict URL Access

Should the public be able to access the admin console URL? Can they access admin pages directly without logging in first?

A9-Insufficient Transport Layer Protection

Do you have SSL/TLS enabled? This isn't so much a WP thing so much as a general security best practice.

A10-Unvalidated Redirects and Forwards

Can attackers trick WP users into being redirected to malicious sites?

The following types of vulnerabilities have been, at some point, confirmed to have existed in WordPress software: Denial of Service, XSS, Information Leakage, Privilege Escalation, Code Execution, SQLi, Unauthenticated Bypassing to access files, XSRF and Directory Traversal. Source: CVEDetails

Hope that helps!

  • Wow this is great, and I'm sure this list will be a great resource for others. Thank you so much! Commented Jan 30, 2013 at 14:29

The best thing to do is to look at the CVE Details website for Wordpress. There are a number of vulnerabilities mentioned against various versions. You'll see that CVE-2012-4448 is a CSRF vulnerability (OWASP 2010-A5).

  • I went through each security vulnerability for WordPress on the CVE Details Website, and learned a ton in the process. Your suggestion helped me learn a ton on my own and I thank you for it! Commented Jan 30, 2013 at 14:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .