A recent analysis underscores a significant security concern: over 70% of publicly available WordPress websites are operating on outdated PHP versions, thereby heightening their susceptibility to cyber threats.
PHP Vulnerabilities in WordPress Sites
This situation highlights a substantial security gap in the global web ecosystem. Despite the availability of regular security updates, a large number of websites continue to rely on outdated backend technologies.
WordPress, which is responsible for powering more than 40% of all internet sites, relies heavily on PHP as its primary server-side scripting language. Although WordPress frequently rolls out updates, the PHP versions in use often remain neglected.
Security Risks of Using End-of-Life PHP Versions
Data from over 316,000 WordPress sites reveals that only about 30% are utilizing a current and supported PHP version. The rest are using versions that have reached their end-of-life, such as PHP 7.4, which has not received security updates since November 2022.
This creates a critical security risk as attackers actively search for such vulnerabilities. A notable example is the ongoing “Hacked by MR.GREEN” defacement campaign, where over 900 compromised websites were identified, primarily due to outdated software.
The Impact of Plugins and Configuration Issues
Plugins, while enhancing functionality, also introduce additional vulnerabilities. Censys data shows that many websites use plugins without keeping them updated, increasing exposure to threats.
Popular plugins like Yoast SEO are often not updated to their latest versions, leaving sites open to exploits such as authentication bypass or data exposure vulnerabilities.
Challenges also arise from the architecture of CMS platforms, where updating PHP versions is not straightforward. Concerns over compatibility, broken functionalities, and potential downtime often lead administrators to postpone updates, compromising long-term security.
Addressing the Cybersecurity Challenge
Misconfigurations add to the risks. Exposed services and weak authentication settings, combined with outdated software, create a highly exploitable environment. Automated tools used by attackers can identify these vulnerabilities at scale.
Security experts stress the importance of maintaining updated backend infrastructure alongside visible components like themes and plugins. Regular updates, proper configuration, and proactive monitoring are critical to minimizing the attack surface.
As threats continue to evolve, the failure to update core technologies like PHP leaves a significant portion of the internet vulnerable to opportunistic attacks.
