Proactive Monitoring for Vulnerabilities in New Versions of WordPress Plugins

When we began our service, our data set of vulnerabilities in WordPress plugins consisted of vulnerabilities that had been publicly disclosed. That allowed us to warn our customers if they were using plugins known to be vulnerable.

At that time, we started monitoring for the exploitation of previously undisclosed zero-day vulnerabilities, which are vulnerabilities being exploited before the developer is made aware of them. That has allowed us to help our customers protect themselves from vulnerabilities that they otherwise would not have had the ability to know about despite hackers already being aware of them. Much to our surprise, this is something that other security providers have not been doing, even ones that promote that they are (security companies, it turns out, are not all that honest).

We then introduced the ability for our customers to suggest/vote for plugins to receive security reviews from us.

In June 2017, we added an additional layer of monitoring to help protect our customers against vulnerabilities in WordPress plugins. We are now checking for indications that new versions of plugins include serious security vulnerabilities. We first use pattern matching to identify code in new versions that have the potential to be exploited. We then manually review the code to see if there is in fact an exploitable vulnerability. Through this, we have found quite a few vulnerabilities.

Far too many of those vulnerabilities have not been fixed, so even if you are keeping your plugins up to date, you could be vulnerable. By using our service not only do you get warned if you are using those vulnerable plugins (many of which no other service that provides similar data will warn you about), but we are there to help you to make the best decision on how to deal with the situation.

Currently, we are limited in how many types of vulnerabilities we can monitor for because of the time it takes to handle each possible vulnerability. If we had more customers, we could increase the number of types of vulnerabilities we monitor for and help to make WordPress plugins even more secure.

We run all the plugins used by customers of our service through that monitoring system on a weekly basis, so even if those plugins have not been updated, we can catch vulnerabilities in them. We check for a wider range of vulnerabilities with that as well.

Some of the Vulnerabilities Found Through Our Proactive Monitoring