The prevalence of Web malware has increased by 140% in the past two years. As a blogging platform and content management system (CMS), WordPress has seen a huge surge in popularity. Today, WordPress powers nearly 17% of websites. However, this popularity comes at a cost; it makes WordPress vulnerable to Web-based malware attacks. The reason is simple: its reach allows for maximum impact. Yes, popularity is good, but it also means that we, as WordPress users, are vulnerable.

The combination of old versions of WordPress, theme and plugin vulnerabilities multiplied by the popularity of the CMS, and the vulnerability of the end user makes for a vulnerable site. The first issue is outdated versions of WordPress, Plug-ins and themes vulnerabilities are another problem. There are 20,000+ plugins in the WordPress repository, and the number is increasing. The quality of plugins varies; some plugins have security flaws, and others are outdated.

Then there is the popularity of WordPress. There is no doubt about it. As of May this year, there are about 700 million websites listed as using WordPress. The popularity of WordPress means that if one hacker finds a way to hack into a single WordPress website, he has the potential to hack millions of websites as a playground. He doesn't need to hack WordPress websites that are using the current version; he can search for websites that are using old insecure versions of WordPress and hack those too.