WordPress continued to be the most attacked content management system (CMS) attracting an even higher percentage of CMS centered cyberattacks in 2018, according to a new Sucuri report.
WordPress, which holds a 60 percent market share in the CMS space, was the focus of 90 percent of the attacks, up from 83 percent in 2017, according to tracking firm W3Techs. This level of attention can be explained by the fact that WordPress heavily dominates the CMS market. Its next closest competitor is Joomla! with a 5.3 share, Drupal with 3.5 percent and Shopify with a 2.7 share.
Magento, Joomla and Drupal were the next three most attacked systems. Magento was hit 4.6 percent of the time, Joomla! 4.3 percent and Drupal 3.7 percent. In each case the number attacks against these CMSs increased year over year.
Sucuri noted the increases for each CMS were not due to any specific event or type of cyberattack, but likely due to:
• Security configuration issues
• A lack of security knowledge or resources
• Overall site maintenance by webmasters
• Broken authentication and session management
The good news is the automatic updating systems used by WordPress and Drupal helped limit the number of successful attacks on each CMS due to the software being out of date, Sucuri reported.
“WordPress experienced a decline in the number of outdated vulnerable versions of WordPress at the point of infection. In 2017, 39.3% of hacked WordPress sites recorded outdated installations. In 2018, this had dropped slightly — a total of 36.7%,” the report said.
Drupal saw a 2.2 percent decline, but Joomla!, which does not offer automatic updates saw a 17.7 percent increase in attacks due to out of date versions being in service. Magento was up 2.8 percent.
“This trend in outdated versions supports the idea that e-commerce sites are notorious for straggling behind on updates to avoid breaking functionality and losing money. Unfortunately, these are also critical systems that are the backbone of online commerce (eCommerce). These are also sites run by organizations that have an obligation to be in compliance with the standards set forth by the Payment Card Industry Data Security Standards,” the report stated.