Two security flaws published in the past fortnight were under attack within days. Neither needed a login.
The gap between a flaw going public and attackers using it is no longer measured in months. It’s measured in days. If your website is updated once a quarter, it spends most of that quarter exposed to flaws that are already public, documented and, in some cases, being used against websites like yours.
WordPress itself: a way in without a password
Most WordPress security issues live in plugins. This one sat in WordPress itself.
The flaw let an attacker run their own code on a site’s server without logging in. In practical terms, that can mean a full takeover of the site and any customer data it owns.
WordPress made it public and released a fix on 28 October. Six days later, on 3 November, the US government’s cybersecurity agency (CISA) confirmed attackers were using it. One security firm reported blocking more than 12,000 attack attempts in a single day.
Six days from disclosure to confirmed attacks. A site waiting on a quarterly maintenance cycle stays exposed for weeks after the attacks start.
Your contact forms are an entry point
Forms sit on almost every business website, which is exactly what makes them worth attacking. Two of the most popular WordPress form plugins had serious flaws published in the same fortnight.
- Gravity Forms: a flaw in this popular premium forms plugin lets an attacker run commands on your server without logging in. It’s rated 9.8 out of 10 for severity.
- Contact Form 7: a flaw in one of the most widely used form plugins lets anyone upload a file that could be used to take over the site.
Neither has been confirmed as under attack yet. Patchstack, which published both, expects the Gravity Forms flaw to be picked up in mass attacks. Fixes are available for both. Whether they’re installed on your site is the only question that matters.
Online stores: orders changed without logging in
If you sell online, your checkout is the part of your site attackers care about most. Two reports in the past fortnight show why.
A flaw in Drupal Commerce, the cart and checkout behind more than 42,000 online stores, lets anyone edit orders without logging in, in ways that can cost a store revenue. Drupal said attackers were already using it when it announced the flaw, and told store owners to audit their past orders.
Separately, security firm Sansec found 953 online stores, mostly on Magento, quietly running malicious scripts for anyone who visited. At least one was still missing a fix Adobe had already released. Another was fully patched and got in through a rogue admin account.
The platform differs. The lesson doesn’t. An update closes the door. It doesn’t undo what got through while it was open. Whatever your online store runs on, review your orders, admin accounts and uploaded files, not just which version you’re on.
Update frequency is a business decision
Quarterly updates made sense when attackers took months to start using a new flaw. That’s no longer often enough.
The cost of monthly maintenance is predictable. The cost of a compromised site, a breached customer database or a month of tampered orders isn’t.
If your site isn’t on a maintenance plan, or is only updated a few times a year, talk to us about monthly Proactive Security & Maintenance.
Not sure when your website was last updated? Send us your URL and we’ll tell you within a day, for free.
