Your WordPress Vulnerability Scan Came Back Clean. Are You Still Exposed? - WPSec

-->

Skip to content

Main Menu

As WordPress continues to power a sizeable share of the web (well over 40% of all websites), the question every site owner eventually asks is a simple one: "Is my site secure?" For most people, the answer comes from a vulnerability scan. You run a scan, it reports no known issues, and you breathe a sigh of relief.

But a clean vulnerability report only tells you half the story. It confirms that none of your installed software matches a known security flaw today. It says nothing about how much of your site is exposed to attack in the first place. Industry analyses consistently attribute the overwhelming majority of WordPress vulnerabilities (by most counts, around 95%) to plugins and themes rather than the core platform. And here is the uncomfortable part: every plugin you install widens the area an attacker can reach, even when that plugin is perfectly patched and has no known vulnerabilities at all.

Related: Reducing the WordPress Attack Surface

In this article, we will look at what an "attack surface" actually is, why a clean vulnerability scan is necessary but not sufficient, and how WPSec’s Attack Surface Analysis measures the exposure of every plugin on your sites, so you can see exactly where you are exposed and act on it before an attacker does.

Please note: Attack Surface Analysis is a new, experimental feature that we are still testing, and the per-site analysis in your WPSec dashboard is available only to premium (paying) customers. Anyone, though, can look up the attack surface of any individual plugin in our public database at attacksurface.wpsec.com, which now covers over 118,000 plugins.

What is an "attack surface"?

Your attack surface is the sum of all the points where an attacker could try to get in. Think of your website as a house. A vulnerability scan checks whether any of your locks are known to be faulty (a useful thing to know). But it does not count how many doors and windows you have in the first place. A house with one front door is far easier to defend than a sprawling property with forty entrances, even if every lock is brand new.

In WordPress terms, each plugin you add brings its own doors and windows. Concretely, those entry points include:

REST API endpoints : the standard way WordPress exposes functionality to apps, mobile clients, and the browser. Every endpoint a plugin registers is another route into your site.

Input parameters : every GET, POST, header, or cookie value a plugin reads is a place where malformed or malicious input can be sent.

File-upload handlers : code that accepts uploaded files. Mishandled, an upload can become the single most dangerous door of all, because it can lead to an attacker running their own code on your server.

WordPress hooks : the AJAX handlers and action hooks a plugin wires into. These are WordPress-specific input mechanisms, and each one is another way to reach the plugin’s logic.

None of these are bad in themselves; they are how plugins do useful work. But the more of them you accumulate, the more an attacker has to aim at. A plugin can be fully up to date, with a spotless track record, and still represent a large, complex attack surface simply because of how much it exposes.

Why a clean vulnerability scan isn’t the whole story

It helps to think of security risk in two separate dimensions.

The first dimension is what is known to be broken right now . This is what a traditional vulnerability scan measures: it compares the versions of your plugins, themes, and WordPress core against a database of known vulnerabilities and tells you where you match. This dimension is temporal: it changes as new vulnerabilities are discovered and as you apply patches. It is essential, and you should absolutely keep doing it.

The second dimension is how exposed you are by design . This does not depend on whether a vulnerability has been published yet. It depends on the structure of the code you are running: how many endpoints it exposes, how much input it accepts, whether it handles file uploads, how complex it is. This dimension is intrinsic to the plugin, and it barely moves when a patch lands.

These two dimensions are largely independent of one another. A plugin can have zero known vulnerabilities and a very large attack surface. Another can be small and tightly scoped yet currently carry a serious flaw. A vulnerability scan sees the first plugin as perfectly clean. Attack Surface Analysis is how you see the risk the scan cannot.

This matters most when tomorrow’s vulnerability is discovered. When a new flaw is announced in a widely used plugin, the sites that get hurt are the ones already running a large, exposed surface. Knowing where your exposure is concentrated before that day arrives is what turns a frantic emergency into a routine update.

What WPSec’s Attack Surface Analysis measures

WPSec performs automated static...