Is Your WordPress Website Vulnerable?

Hi, everyone. I’m Lisa, founder of Five Penny Web Studio, and this is the No Stress Web Success Podcast.

I want to welcome everybody back to our series, Web Understood, where we discuss everything website—covering the latest news, website security, compliance, analytics, and much more.

First of all, it is late for a Friday. I normally have these things out first thing in the morning, and it does not matter how techy you are or not—technical difficulties happen. So it’s a lot later on Friday, but I am getting my podcast out because I told you Wednesdays and Fridays. So here we go. Let’s get started.

I wanted to discuss the WordPress core version 7.1.1 that was suffering from a vulnerability last week. Any version before that, there was an issue with attackers that could break out of the allowed folders and access files they shouldn’t have access to. This vulnerability carried a CVSS score of 9.2, which is pretty high, and WordPress 7.1.2 is the patched version.

Another threat that also came out was for the Elementor website builder, and its CVSS score was 8.8. Elementor versions 4.3.0 and 4.3.1 contained a cross-site request forgery vulnerability that could allow an attacker to trick users into performing actions using the REST API. Essentially, in English, logged-in users could be tricked into performing actions that they didn’t intend, like changing passwords or making purchases. Elementor released version 4.3.2 on September 24th, and anyone that has not updated either their WordPress or Elementor should do so immediately.

What’s really important about the Elementor vulnerability is that it is active on more than 10 million WordPress sites. It’s a huge following for WordPress users. So when you look at a plugin that has a vulnerability like that, it really affects a large portion of the WordPress ecosystem.

Let’s talk a little bit about the vulnerabilities in general. WordPress 7.0 was released this past May. And we’ve already seen over twenty or so WordPress vulnerabilities reported just since July 17th that are affecting the core. Now, this exact number can change as new disclosures are published, but the message is clear: WordPress security requires ongoing attention, not occasional maintenance.

This brings up a really good topic for everybody, and this is something I want you to consider. The question is: if something happens to your website today, do you know how to react? Do you know how to restore it? Do you have reliable backups?

We all need to sit there and take an inventory of our access, our tools, our resources—and we actually need to do this on a regular basis. Vendors, staff, people come and go. Tools change. So it never hurts to do this once or twice a year. Make yourself a list and just go through your website and start doing an inventory.

Here’s some of the things you can consider:

Your WordPress core, plugins, and themes all need to be updated. Do you have somebody taking care of that? Are you taking care of it yourself? Are they taking this on a regular basis, or is it one of those “we think about it every once in a while” kind of things?

A lot of times, people tend to think that they don’t update the content on their website very often. It’s more of a static site—we just want people to know we have a website and we’re here. But just because your content doesn’t change regularly doesn’t mean it doesn’t need to be maintained and monitored. Still have people go in, check the updates, and keep everything on the current, latest patches. And if you don’t have somebody assigned to that, make sure you get somebody. That is the one thing to do.

The other thing to look at is your backups. Do you maintain frequent off-site backups? With WordPress, a lot of times the backups can be done through a plugin. But those plugins have to be configured correctly. They have to be scheduled. You want to check your backups. You want to see how they’re configured. How often do they back up? Is it backing up the WordPress site and the database both, or just one? Where are those backups stored? Are they on the same site and same host as your WordPress site, or are they stored off-site with Google Drive, OneDrive, or Dropbox? Those are questions you want to answer.

How easy is it to restore? Is it just pushing a button somewhere, or is there more of a manual migration that needs to be done? Answer these questions so that when you do have to restore something, you know what to do and who to go to.

Another thing is staging sites. Some hosts will provide a staging site for you, and I suggest you take advantage of them if you have one. This is a good place for you to basically make a copy of your live site and update—especially when you have a major update coming through. Make sure your site is functioning properly, there’s no issues, no compatibility problems between a plugin and a theme. And once it’s good, then you can publish it and it becomes your live site. This gives you a chance to test these major updates without having to worry about what your users are going to see on your live site.

You also want to take an inventory of your administrator accounts. Who has admin access to your website? Look at the email addresses. Are these email addresses still current? Is it a shared email that multiple people have access to? Do you have multi-factor or 2FA set up on your admin accounts? Do you have people in there with access that no longer work with the company or shouldn’t have access at all? Just take a close look and see who’s there and see what cleanup needs to be done.

Lastly, if you cannot manage your updates and the maintenance of your WordPress site yourself, I highly recommend finding a trusted WordPress professional that you can depend on. There’s still some of us out there that that is what we do. We monitor WordPress sites, we keep them updated, we troubleshoot issues. Rely on somebody or find somebody in your company that you can assign this task to. It will pay off for you in the long run.

The biggest thing is that updates can occasionally cause compatibility problems, and that tends to make people hesitant to run updates. But leaving these vulnerabilities untouched—not patching things as they come out—can put your entire website and your reputation in a bad place. You never know, and a lot of it depends on what your website’s being used for, is it attached to other things on your network, and then you have the whole domain name concern. Because if your website becomes compromised, that attaches itself to your domain. That same domain name is used for your email. It becomes kind of a domino effect. Just keep your reputation good and clean. Keep yourself off the blacklist.

I actually have a simple, quick checklist that you can use to take inventory of all this, and I’d be happy to share that with you. So if this is something you’re interested in, go to my website at fivepennyweb.com and just let me know that you are interested in our WordPress inventory checklist, and I will get that sent to you.

The thing that we want to do here is just to make sure that you’re staying safe, staying secure, and that you’re keeping an eye on these vulnerabilities. Because as soon as one or two of them go away, one or two come back.

We’re always here to answer your questions. If you have any topics or questions that you would like specifically addressed, reach out to me. Give me some feedback, let me know, and I will be happy to answer any questions you may have.

And one more piece of information: you know how important SEO is to everything—not just websites, but also the podcasts. So we’ve been taking some feedback, and we may be changing the title of the podcast a little bit, maybe changing our podcast art, but essentially, we’re staying the same. We’re focused on accessibility, we’re focused on website security, compliance, answering the everyday questions you may have. So it’s just gonna look a little different, that’s all. You may see those changes next week, but I hope you’re gonna follow me for the ride and stay with me, and we’ll see where it goes from there.

Once again, sorry I’m late on Friday, but I’ll do better next week. So have a great weekend, and I will talk to you soon. Bye.

*Updated 10/19/2026; name and cover art will not change at this time, so keep looking for us at No Stress Web Success.