---
title: Vulnerability
canonical: https://wpsecurityninja.com/dictionary/vulnerability/
---
# Vulnerability

A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.

Last updated: 2026-08-26

Also called: security vulnerability

## Related terms

- [Plugin supply chain](https://wpsecurityninja.com/dictionary/plugin-supply-chain/): Plugin supply-chain risk is when trusted plugin code or updates become a path for attackers.
- [Privilege escalation](https://wpsecurityninja.com/dictionary/privilege-escalation/): Privilege escalation is gaining higher access than intended, such as a subscriber becoming an administrator.
- [Security audit](https://wpsecurityninja.com/dictionary/security-audit/): A security audit is a structured review of a site’s risks, misconfigurations, and recommended fixes.
- [CVE](https://wpsecurityninja.com/dictionary/cve/): A CVE is a public identifier for a known cybersecurity vulnerability tracked in shared databases.
- [Remote code execution](https://wpsecurityninja.com/dictionary/remote-code-execution/): Remote code execution is a vulnerability that lets an attacker run attacker-controlled code on the server.
- [Scheduled scanning](https://wpsecurityninja.com/dictionary/scheduled-scanning/): Scheduled scanning runs security checks automatically on a repeating timetable and can alert you to new findings.

[Full guide](https://wpsecurityninja.com/wordpress-vulnerabilities-database/)

## Why it matters for WordPress

Most breaches start with a known vulnerable plugin or theme, not a brand-new zero-day against core. Automated scanners look for unpatched versions within hours of a public advisory. Severity and fixed-version notes tell you whether to update today or tonight.

## How it shows up in practice

- CVE identifiers and changelog lines that say “security fix”
- Scanner results listing component, installed version, and severity
- Public write-ups with exploit details that bots soon automate
- A plugin you forgot about, still active, years behind on updates

## What to do

1. Know what is installed and which versions are live.
2. Update when a fix ships; remove abandonware you cannot patch.
3. If you cannot update yet, mitigate: WAF rules, disable the plugin, restrict access.
4. After patching, confirm the version and watch logs briefly for probe traffic.

## In WP Security Ninja

The [vulnerability scanner](https://wpsecurityninja.com/vulnerabilities/) flags known issues in installed plugins, themes, and core so you are not waiting on a news roundup. Pair it with [security tests](https://wpsecurityninja.com/security-tests/) and a patch habit. Reference: [WordPress vulnerabilities](https://wpsecurityninja.com/wordpress-vulnerabilities-database/).