WordPress Vulnerabilities and Outdated PHP in Enterprise Security

More than 40% of publicly accessible websites worldwide are powered by WordPress, relying on PHP as a fundamental backend. Despite the availability of free updates, over 70% of these resources use PHP versions that have reached their end-of-life (EOL). The convenience of content management systems (CMS) allows for quick network presence building, but this leads to accumulating critical technical debt, which silently expands the attack surface. Censys researchers prove that ignoring timely infrastructure patches transforms corporate sites from a useful business tool into an open gateway for compromise.

SCALE OF THE ISSUE

Analysis of publicly available WordPress instances reveals a paradox: administrators often maintain the frontend component and content but completely ignore the basic infrastructure. According to Censys experts, only 14% of sites are updated to the latest WordPress core version. Considering version 6.9, which ended support in March 2026, this figure reaches only 31%. Meanwhile, around 20% of resources are still running on PHP 7.4, even though official support for this version ended in November 2022. A similar trend is observed among popular extensions. For example, less than 22% of open installations of the well-known Yoast SEO tool run on the current version. This imbalance, where a modern interface hides an unsupported backend, creates the perfect environment for exploiting known vulnerabilities.

ARCHITECTURAL CHALLENGE

The main reason for widespread update avoidance lies in the architectural complexities of migration and potential risks of site functionality disruption. IT professionals often delay implementing new releases due to the lack of compatibility of old components with the new core or reluctance to integrate new features, such as artificial intelligence elements in WordPress 7.0. However, protecting the backend is as critically important as securing the external perimeter. Modernizing PHP is not an optional performance enhancement, but the installation of vital patches. If a web service cannot function safely after an update, its architecture is outdated and requires a deep overhaul or strict access limitations through control measures.

FUNCTIONAL FOCUS

Modern web environments are critically dependent on third-party plugins that add new functionality. Since extensions do not undergo the same rigorous audit as the CMS core, they quickly become the main vectors for intrusion. For example, the popular backup component UpdraftPlus contained serious flaws (CVE-2026-10795) that allowed circumventing authentication mechanisms. The situation is aggravated by classical configuration errors. Attackers massively scan the network for exposed xmlrpc.php interfaces, which allow them to conduct brute-force password attacks. Additional risk factors include SSH ports accessible externally with allowed password authentication. The combination of outdated software and excessive permissions nullifies any attempts to protect corporate data.

CAMPAIGN EXAMPLE

The real consequences of uncontrolled technical debt are vividly illustrated by the defacement attack campaign “MR.GREEN”. As of June 2026, over 900 websites were breached, with their content replaced by messages from the attackers. All victims shared a common profile: using outdated software versions and basic configuration errors, such as open endpoints or leftover files “/wp-admin/install.php”. GreyNoise sensors confirm continuous network scanning by dozens of IP addresses searching for vulnerable xmlrpc.php interfaces. This scenario proves that cybercriminals do not always need sophisticated tools — they succeed through automated scanning of well-known flaws in poorly protected infrastructure.

PRACTICAL IMPLEMENTATION

Reliable protection of corporate digital assets requires regular monitoring. Each major version of PHP has a four-year lifecycle during which security patches are released. Considering the public release of PHP 8.6 is scheduled for November 2026, companies need to prepare timely for architectural migration. Administrators should approach automatic update features with caution: installing new core versions requires prior manual testing in an isolated environment before final deployment. For a global assessment of their attack surface, IT departments can use Censys platform solutions, making targeted inquiries into their assets. This helps quickly identify forgotten services, open ports, and outdated components with known CVEs.

Today, successful corporate site breaches are primarily the result of inadequate digital hygiene rather than the use of complex penetration methods. Scaling functionality must always accompany stringent infrastructure responsibility and transitioning from a passive hosting model to proactive risk management.

iIT Distribution, as a specialized cybersecurity solution distributor, assists companies in building a comprehensive protection strategy. The iITD team provides competent technical expertise, conducts architectural consultations, and ensures full project support at all stages of implementation. Years of experience and official collaboration with leading international manufacturers, including Censys, guarantee partners access to the best vulnerability detection practices and reliable IT infrastructure protection against modern threats.

NEWS