Vulnerable WordPress plugins: how to check yours for security flaws

Why an "updated" site still gets hacked

The WordPress updates screen only knows about things that have a new version available. There are five cases where a vulnerable plugin never shows up there:

• Plugins closed on WordPress.org. When the directory closes a plugin over an unfixed security issue, it stops offering new versions. Your dashboard shows nothing pending because there is nothing to install.
• Abandoned plugins. The author stopped maintaining it. It still works, but any flaw found from now on will never be fixed.
• Premium plugins with an expired license. Elementor Pro, WPML, ACF Pro or WooCommerce extensions update from their author's servers, and only with an active license. Without one, the plugin stays on its version, flaws included.
• Nulled copies. A premium plugin downloaded for free from a third-party site never updates and, on top of that, often ships with a backdoor built in.
• Plugins bundled with the theme. Some commercial themes include a plugin (a slider, a page builder) that only updates when the theme author releases a new version.

And there is a sixth case that has nothing to do with updates: an inactive plugin is still on the server. Many flaws are exploited by calling the plugin's files directly, so deactivating it does not protect you. If you do not use it, delete it.

Step 1: get the real list of plugins and themes

In the dashboard, Plugins → Installed Plugins shows every plugin with its version, active and inactive. Check Appearance → Themes too: themes you do not use count as well. And use your hosting file manager to look in wp-content/mu-plugins/, because plugins there ("must-use") do not appear in the normal list.

With SSH access and WP-CLI it is faster, and it also tells you each plugin's status on WordPress.org and when it was last updated there, which is the quickest way to spot closed and abandoned plugins:

wp plugin list --fields=name,status,version,update_version,wporg_status,wporg_last_updated
wp theme list --fields=name,status,version,update_version
wp plugin list --status=must-use

Write down each plugin's technical name (the name of its folder in wp-content/plugins/, which is what appears in the name column), not its marketing name: that is what you will search for in the vulnerability databases.

Step 2: check the list against vulnerability databases

There are three public databases, free to search, that track flaws in WordPress plugins and themes with the affected version and the fixed one:

• WPScan, by Automattic. It is the one Jetpack Protect uses.
• Wordfence Intelligence, by Wordfence.
• Patchstack. It is the one Solid Security uses for its virtual patching.

Search for each plugin by its technical name and compare your version with the affected ones. If your version is in the range and a fixed version exists, update. If there is no fixed version, go to step 3. For WordPress core, the sensible thing is to always run the latest version; minor updates, which are the security ones, install automatically by default unless someone turned that off.

Step 3: if one of your plugins has an unfixed flaw

1. If you do not need it, delete it. Deactivating is not enough: delete it from the dashboard or remove its folder from wp-content/plugins/.
2. If you need it, replace it with a maintained plugin that does the same job. Make the switch with a backup first, and test it on a copy of the site if it is a store.
3. While you decide, a firewall with virtual patching (from a security plugin, or from your hosting provider or CDN) can stop known attacks against that flaw. It is a stopgap, not a fix.
4. Check whether someone is already in. If the flaw was serious and you were exposed for months, updating closes the door but does not kick out anyone already inside. The signs are in how to tell if your WordPress site is hacked.

Automatic updates: yes, with a backup

Since WordPress 5.5 you can turn on automatic updates plugin by plugin and theme by theme, from the Automatic updates column on the plugins screen. WordPress runs them twice a day and emails you the result. On a simple business website, turning them on for well-maintained plugins greatly cuts the time you spend exposed. On a store, it is better to update by hand, or with someone who tests checkout afterwards, because an update that breaks the cart costs sales.

In both cases the condition is the one the WordPress documentation sets: have a recent automatic backup and know how to restore it.

How often to check

• Every week: pending updates and alerts from your security plugin. Flaws get published and start being exploited within days.
• Every month: the full list, with WP-CLI or from the dashboard, to catch closed, abandoned or unlicensed plugins.
• Every time you install something: check when it was last updated, how many active installs it has and whether the author answers in the support forum. Fewer plugins, fewer doors.

If you would rather I check it

The free scan detects, from the outside, your WordPress version and the plugins that are publicly visible, and checks them against published flaws. For the full list, including inactive plugins and the ones not visible from outside, there is the security report with the read-only connector (€129, excluding VAT). And if you would rather not think about it, WordPress maintenance (€35/month, no lock-in) includes weekly updates with a backup first and replacing abandoned plugins.

Sources

• WP-CLI: wp plugin list (the update_version, wporg_status and wporg_last_updated fields, and the must-use status).
• WordPress: plugin and theme auto-updates (since WordPress 5.5, twice a day, with an email notice and the recommendation to keep automatic backups).
• WordPress.org: detailed plugin guidelines (a plugin with security issues is closed until they are resolved).
• WordPress: must-use plugins (always loaded and not shown in the normal list).
• Vulnerability databases: WPScan, Wordfence Intelligence and Patchstack.