Nearly 1000 Plugins Closed During WordPress Security Cleanup

Patchstack is always looking for new ways to make the WordPress ecosystem safer by organizing various events for ethical hackers and security researchers. Our experiments sometimes lead to unexpected results. Also, these events sometimes uncover issues that were overlooked before.

Our latest experiment took place in October. We announced a special event for our Bug Bounty program in October as part of Cyber Security Month, and we decided to make it count by cleaning the WordPress repository of old vulnerable plugins. And what better way to do this than by running a special event with many ethical hackers?

TL;DR

• 1571 valid security vulnerability reports received in October alone. More than $17K in rewards were paid to ethical hackers who contributed to making the WordPress ecosystem safer for everyone!
• Many plugin devs are impossible to reach, resulting in over 1000 plugins/themes to be temporarily closed in October. Plugins really need to set up proper VDPs – it’s easy!
• The security community behind WordPress is stronger than ever. Patchstack Alliance is open to everyone. Don’t miss out on our future events – so join us now!

So let’s get to the details!

The usual Bug Bounty rules were adjusted to put all possible plugins and themes into the scope:

1. Reports for plugins/themes with less than 1K active installs will get the same points as components with 1K active installs.
2. There’s no limit of 3 years since the last update for the October competition.
3. Both exceptions to the rules are applied only for reports with these prerequisites. The vulnerability CVSS score must be at least 6.5 if you want rules “1” and “2” to be applied.

The event took off rapidly. It went so well that in the middle of the month, we added one extra challenge: “If you discover 1000 (or more) valid reports this month, we will give an extra +$100 bounty to everyone who has reported at least ten reports with CVSS higher than 6.5.”

And they did it. We had big expectations, but not as big as the actual result. The number of valid vulnerability reports shocked us—1571 valid reports (affecting 7141940 active installs) in total by 37 researchers. That’s huge on its own, but when we look at our previous record, 620 (January 2024), we can see even better how huge it was. It was pretty cool to see what the growing Patchstack Alliance community of ethical hackers and security researchers can achieve in one month.

As expected, most reports were for the vulnerabilities found in the plugins.

Looking at the overall report count numbers does not give a clear vision of what was discovered, so we started to dig deeper into the statistics, where the scary details began to appear.

Results in numbers

One industry standard for measuring the severity of vulnerabilities is a CVSS (Common Vulnerability Scoring System) score, which includes several essential parameters to give an idea of how dangerous a vulnerability is. CVSS results for vulnerabilities discovered in this event were the main trigger for looking at results from a slightly different angle.

The two first lines of these stats represent the most common types of vulnerabilities in the WordPress ecosystem: Reflected and Stored Cross-Site Scripting issues. This is normal, and if we check stats from other events that would be similar, the unusual part is that the third, fourth, and eighth lines are for the highest severity vulnerabilities (ranging from 9.8 to 10.0).

Altogether there were 164 reports with CVSS 9.0+ and 270 reports were 8.0+.

Sure, some researchers tried to get as many points as possible, but it’s an obvious indicator that it wasn’t that hard to find such critical issues.

You can get an even clearer picture by looking into vulnerability types. Most of those dangerous vulnerabilities have been in the repository for over a decade. Yes, you read it correctly. Most reports were for plugins and themes, which were last updated 6 to 11 years ago. Do you think that’s a lot? One report was for the plugin that was last updated 17 years ago, yet there are still live websites depending on it.

Another aspect that strongly suggests this event removed some nasty vulnerabilities from the repository is the statistics of prerequisites (the minimal role needed to exploit the vulnerability successfully).

As you can see, most of those vulnerabilities could be exploited without authentication. Usually, that would show that there are many CSRF reports as we consider them to be the ones that don’t need any authentication (from the attacker’s perspective). However, if you look at the table above again, you will notice only 152 CSRF vulnerabilities.

That’s why we made an extra check and filtered out only vulnerabilities that did not require authentication from any perspective (neither from the attacker nor from the other users). We got 194 vulnerabilities, which is 12.35% of the whole catch.

Patchstack is the most extensive CNA working on WordPress vulnerabilities, with over 6K CVE IDs already published. By processing all those vulnerabilities, we’ve noticed that many vendors/developers don’t care how people can contact them and report vulnerabilities. This is a big problem for which we even created the free mVDP program for every WordPress plugin and theme.

Can we measure this problem? Yes! Out of 1571 reports, at least 1162 were sent to WordPress plugins and themes review teams because the vendors’ contacts were unavailable, outdated, or not working (broken contact forms, bouncing back emails, URLs pointing to dropped domain names).

We want to thank the WordPress plugins review team, which worked with us closely and provided quick reactions to all our reports.

Consequences to the WordPress Plugins Repository

Each event has an outcome. In this case, again, we have something extraordinary. As we mentioned before, most of those plugins already looked abandoned or their developers were not accessible, so we were forced to report those vulnerabilities to the plugin review team. Such reporting often results in a plugin closure.

At the time of writing, 977 plugins are closed already (most of them temporarily, but if authors don’t take any action, the status will change). This is about 1.1% of all plugins in the repository.

While removing those vulnerable plugins is a great thing because we are making the repository safer, the problem with the visibility of closed plugins still exists. This means many users will still use those plugins and won’t even see any indicators of a security risk.

On the bright side, after many years, we are finally seeing some movement in this matter. There is even an experimental plugin allowing us to show statuses inside the admin panel. Kudos to Dion Hulse for pushing this. Now, we just hope that it will get merged sooner rather than later and that we won’t have to write about this topic again.

Some more stats

We want to share some stats about our rockstars who made this event that good. On average, each reporter submitted 43 reports. You can also see the October leaderboard here.

The highest AXP for one submission goes to TaiYou – 558.90. It’s also the highest score in Patchstack’s history. You can read more about it in this article.

While most of the findings got less than <1000 active installs (1471), there were also 2 reports for plugins with more than 1M active installs. On average there were 4551 active installs per report, giving a total of 7141940 active installs affected.

Everyone who made it possible 🥇

Also, the Lucky Researcher award goes to casol 🍀

Time to start the November Bug Bounty 📅

October was really difficult – submitting that many reports is not an easy task. That’s why in November we aren’t launching any special events, so we can all recharge a bit.

But it doesn’t mean nothing will happen. Soon we’ll announce more details on a Capture The Flag event we’ll host this month. All the challenges are created by our Alliance members.

Also, don’t forget to join our Discord, where you can find all the amazing conversations and learn from others. And if you want to learn more about security – check out the Patchstack Academy.