---
title: Vulnerability
canonical: https://wpsecurityninja.com/dictionary/vulnerability/
---
# Vulnerability

A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.

[Full guide](https://wpsecurityninja.com/wordpress-vulnerabilities-database/)

## Why it matters for WordPress

Most breaches start with a known vulnerable plugin or theme, not a brand-new zero-day against core. Automated scanners look for unpatched versions within hours of a public advisory. Severity and fixed-version notes tell you whether to update today or tonight.

## How it shows up in practice

- CVE identifiers and changelog lines that say “security fix”
- Scanner results listing component, installed version, and severity
- Public write-ups with exploit details that bots soon automate
- A plugin you forgot about, still active, years behind on updates

## What to do

1. Know what is installed and which versions are live.
2. Update when a fix ships; remove abandonware you cannot patch.
3. If you cannot update yet, mitigate: WAF rules, disable the plugin, restrict access.
4. After patching, confirm the version and watch logs briefly for probe traffic.

## In WP Security Ninja

The [vulnerability scanner](https://wpsecurityninja.com/vulnerabilities/) flags known issues in installed plugins, themes, and core so you are not waiting on a news roundup. Pair it with [security tests](https://wpsecurityninja.com/security-tests/) and a patch habit. Reference: [WordPress vulnerabilities](https://wpsecurityninja.com/wordpress-vulnerabilities-database/).