According to an analysis by WhiteSecurity WP and EnableSecurity, UK-based security consultants, incomplete updates, and sometimes no updates at all, leave a large number of WordPress vulnerable to cyberattacks.
The study, which includes 42,106 WordPressthat ranked at the top of the Alexa list for a three-day period this month, shows that of the 74 versions of the software in use, only 18.5% have been updated to the latest version, 3.6.1.
The study was conducted on September 12, just one day after the release of the version in question. However, it seems that the prevalence of older versions is still strong. A total of 6,859 websites were using version 3.5.1 (which has eight documented bugs). In addition, 2,204 were using version 3.4.2 (12 bugs) and 1,655 were using version 3.5 (ten vulnerabilities). “This means that 73.2% of the most popular WordPress websites are vulnerable to bugs that can be detected using free automated tools,” says the WhiteSecurity report. “A malicious attacker only needs a few minutes to run automated tools that can discover the vulnerabilities and exploit them.”
