Vulnerability
Definition
A vulnerability is a weakness in software that attackers can abuse to break confidentiality, integrity, or availability.
Also called: security vulnerability
Why it matters for WordPress
Most breaches start with a known vulnerable plugin or theme, not a brand-new zero-day against core. Automated scanners look for unpatched versions within hours of a public advisory. Severity and fixed-version notes tell you whether to update today or tonight.
How it shows up in practice
- CVE identifiers and changelog lines that say “security fix”
- Scanner results listing component, installed version, and severity
- Public write-ups with exploit details that bots soon automate
- A plugin you forgot about, still active, years behind on updates
What to do
- Know what is installed and which versions are live.
- Update when a fix ships; remove abandonware you cannot patch.
- If you cannot update yet, mitigate: WAF rules, disable the plugin, restrict access.
- After patching, confirm the version and watch logs briefly for probe traffic.
In WP Security Ninja
The vulnerability scanner flags known issues in installed plugins, themes, and core so you are not waiting on a news roundup. Pair it with security tests and a patch habit. Reference: WordPress vulnerabilities.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Plugin supply chain Plugin supply-chain risk is when trusted plugin code or updates become a path for attackers.
- Privilege escalation Privilege escalation is gaining higher access than intended, such as a subscriber becoming an administrator.
- Security audit A security audit is a structured review of a site’s risks, misconfigurations, and recommended fixes.
- CVE A CVE is a public identifier for a known cybersecurity vulnerability tracked in shared databases.
- Remote code execution Remote code execution is a vulnerability that lets an attacker run attacker-controlled code on the server.
- Scheduled scanning Scheduled scanning runs security checks automatically on a repeating timetable and can alert you to new findings.
