4 ms·

WordPress is probably the most heavily attacked web apps ever designed. If your serious about security then don't use Wordpress or always keep up with releases.

• pbhjpbhj 17y ago
  It gets more good attention too - it's better designed, easier to use, looks good has a vast range of plugins and templates available for free ...
  • tptacek 17y ago
    Wordpress has what is quite possibly the worst security design of any piece of web software.
    • dryicerx 17y ago
      Their no better or worse than any other, their just heavily attacked since it's so wide spread use. It's preferable write a exploit of find a flaw in something so widespread and carpet bomb them all instead of doing the same for a rarely used piece of software.
      • tptacek 17y ago
        WordPress registers users for comments in the same table as administrators, making anonymous commenters into "administrators" with no privileges. It is constructed almost entirely out of concatenated SQL queries with no explicit parameter bindings. It's internationalized and relies on explicit input filtering. Its templates are executable code; templates can pop a shell. It has, in the actual web application, a "theme editor" that edits that executable code. Because it's built on ad-hoc PHP, it's had --- within the last two years --- remote file inclusion vulnerabilities, where people can load portions of other people's WordPress installs off their own MySpace pages. It supports hundreds of plugins, all of which have the exact same problems and the exact same exposure. vBulletin and Mediawiki are also incredibly popular. But they have nothing resembling the rap sheet that WordPress has. Try another argument.
      • karanbhangui 17y ago
        You do realize you're talking to a security researcher right?
        • deleted 17y ago
          [deleted]
        • tptacek 17y ago
          I'm wrong about security all the time. I like it when people argue with me. But I'm not wrong this time.